Fix memory leaks and add bounds checks in packet/drop handling

GetNewDrop() allocated newdrop up front but returned NULL without
freeing it on every rejection path (failed drop-rate check, missing
drop table, unknown item type, etc.), leaking on every non-drop roll.
Free it on all early-return paths, and only assign a clientid once a
drop is actually going to be returned.

CPacket::AddByte/Word/DWord/QWord/Float now bounds-check against the
buffer before writing, preventing an overflow if a packet is built
past its allocated size.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Src/Common/globals.cpp

@@ -16,32 +16,37 @@ void CPacket::StartPacket( unsigned short mycommand, unsigned short mysize, unsi
 }
 void CPacket::AddByte( unsigned char value )
 {
+	if ( Size < 6 || Size-6 >= sizeof(Buffer) ) return;
 	Buffer[Size-6] = value;
 	Size += 1;
 }
 void CPacket::AddWord( unsigned short value )
 {
+	if ( Size < 6 || Size-6+2 > sizeof(Buffer) ) return;
 	*((unsigned short*)&Buffer[Size-6]) = value;
 	Size += 2;
 }
 void CPacket::AddDWord( unsigned value )
 {
+	if ( Size < 6 || Size-6+4 > sizeof(Buffer) ) return;
 	*((unsigned*)&Buffer[Size-6]) = value;
 	Size += 4;
 }
 void CPacket::AddQWord( unsigned long long value )
 {
+	if ( Size < 6 || Size-6+8 > sizeof(Buffer) ) return;
 	*((unsigned long long*)&Buffer[Size-6]) = value;
 	Size += 8;
 }
 void CPacket::AddFloat( float value )
 {
+	if ( Size < 6 || Size-6+4 > sizeof(Buffer) ) return;
 	*((float*)&Buffer[Size-6]) = value;
 	Size += 4;
 }
 void CPacket::AddString( char* value )
 {
-	for(unsigned char c=0; c<(unsigned)strlen(value); c++)
+	for(unsigned c=0; c<strlen(value); c++)
 		AddByte( value[c] );
 }
 void CPacket::SetByte( unsigned short pos, unsigned char value )