Safeguard substraction in pb_read() (#697)

Previously a custom stream callback could modify bytes_left,
causing the substraction to wrap.

pb_decode.c

diff --git a/pb_decode.c b/pb_decode.c
index 5405c87..58ee5f7 100644
--- a/pb_decode.c
+++ b/pb_decode.c
@@ -111,7 +111,11 @@
         return false;
 #endif
     
-    stream->bytes_left -= count;
+    if (stream->bytes_left < count)
+        stream->bytes_left = 0;
+    else
+        stream->bytes_left -= count;
+
     return true;
 }