`Upstairs::add_ds_region` should verify incoming region definitions

The upstairs/downstairs negotiation logic calls Upstairs::add_ds_region in response to an incoming Message::RegionInfo from a downstairs. Unless I've overlooked something, there's nothing that checks that the RegionDefinition inside the RegionInfo conforms to the limits in common/src/region.rs (block size must be between 512 and 32768, extents have a maximum size of 512 MiB). This might have surprising consequences for downstream consumers of the region definition (e.g. if upstairs gets a bogus definition and someone passes it to Block::new_with_ddef, Block::new will panic).

One interesting consequence of this is that it is possible to have three downstairs successfully connect while reporting different region definitions, as long as the first two report a block size of 0 (so that, when their region definition is copied to the upstairs, the next definition to arrive thinks that nothing has been written yet; see the following snippet): https://github.com/oxidecomputer/crucible/blob/d19e92f7f204b22477ace60e98fc1163d50e28e1/upstairs/src/lib.rs#L5667-L5689

(My changes for #440 will likely clean up this particular example, but I think it'd be good to verify these messages more rigorously if the upstairs isn't doing so already.)

Start in upstairs/src/lib.rs at Upstairs::add_ds_region and read the incoming Message::RegionInfo handling. Compare its RegionDefinition with the limits described in common/src/region.rs, including block size and extent size, and trace the Block::new_with_ddef consequence. Done means malformed incoming definitions are rejected before downstream consumers can receive them, with coverage in the relevant upstairs tests.