[metadata] Fix fuzzer bug with metadata arg. (#32787)

Bug: b/276525236.

src/core/ext/transport/chttp2/transport/chttp2_transport.cc

@@ -445,7 +445,7 @@ static void read_channel_args(grpc_chttp2_transport* t,
         // `GRPC_ARG_ABSOLUTE_MAX_METADATA_SIZE` is not set.
         const int soft_limit = channel_args.GetInt(GRPC_ARG_MAX_METADATA_SIZE)
                                    .value_or(setting.default_value);
-        const int value = (soft_limit < (INT_MAX / 1.25))
+        const int value = (soft_limit >= 0 && soft_limit < (INT_MAX / 1.25))
                               ? static_cast<int>(soft_limit * 1.25)
                               : soft_limit;
         if (value > DEFAULT_MAX_HEADER_LIST_SIZE) {

test/core/end2end/fuzzers/api_fuzzer_corpus/clusterfuzz-testcase-minimized-api_fuzzer-4813636509761536

@@ -0,0 +1,21 @@
+actions {
+  create_channel {
+    target: "unix: {"
+    channel_args {
+      key: "grpc.max_metadata_size"
+      i: 1236454714901355
+    }
+    channel_actions {
+      add_n_bytes_writable: 21
+      add_n_bytes_readable: 18446744069414584320
+      wait_ms: 8
+    }
+  }
+}
+actions {
+  create_server {
+  }
+}
+actions {
+  check_connectivity: true
+}