bpf/verifier: fix bounds calculation on BPF_RSH