Split SIZE_T_CEILING, SSIZE_T_CEILING
For good C practice, we should have separate signed and unsigned values for the ssize_t and size_t ceilings, and avoid signed-to-unsigned comparisons. See comments in bug #2337 (moved) for background.
(We don't want to just make SIZE_T_CEILING unsigned and use it everwhere, since comparing a ssize_t to an unsigned SIZE_T_CEILING is just as broken as comparing a size_t to a signed SIZE_T_CEILING.)