Signed integer overflow in CFeeRate::GetFee(…) reachable via RPC call analyzepsbt #20607

While fuzzing the RPC interface I stumbled upon a signed integer overflow in CFeeRate::GetFee(…) which is reachable via the following analyzepsbt RPC call:

$ ./autogen.sh
$ CC=clang CXX=clang++ ./configure --with-sanitizers=address,undefined
$ make
$ UBSAN_OPTIONS="print_stacktrace=1" src/bitcoind &
$ src/bitcoin-cli analyzepsbt cHNidP8BABMAAAYAAAFdAAAKAAIEAAAAAAAGAAA=
policy/feerate.cpp:26:34: runtime error: signed integer overflow: -59373636730022578 * 1000 cannot be represented in type 'long'
    [#0](/bitcoin-bitcoin/0/) 0x55751767911b in CFeeRate::GetFee(unsigned long) const src/policy/feerate.cpp:26:34
    [#1](/bitcoin-bitcoin/1/) 0x557516e2e6a0 in CFeeRate::GetFeePerK() const src/./policy/feerate.h:60:41
    [#2](/bitcoin-bitcoin/2/) 0x557516e2e6a0 in analyzepsbt()::$_17::operator()(RPCHelpMan const&, JSONRPCRequest const&) const src/rpc/rawtransaction.cpp:1842:85
...

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior policy/feerate.cpp:26:34 in
{
  "estimated_vsize": 19,
  "estimated_feerate": -40334045.08893923,
  "fee": -11280990.97870429,
  "next": "extractor"
}

Nothing high priority of course, but still worth fixing :)

When this is fixed the following two old fuzzing workarounds for the same underlying issue can be removed too:

https://github.com/bitcoin/bitcoin/blob/795afe6e63a173a22597a59606e1c58d34cb3f1a/src/test/fuzz/util.h#L143-L147

https://github.com/bitcoin/bitcoin/blob/795afe6e63a173a22597a59606e1c58d34cb3f1a/src/test/fuzz/fee_rate.cpp#L24-L26

Thanks @practicalswift. I'm about to open a PR to refactor CFeeRate / feerate.{h,cpp} and will verify its behavior with respect to this issue.

Ref #20790, #20391, and #20546.