reject negative cost and call counts in callgrind parser

[nvxbug]

CallgrindParser.parse_cost_line reuses the subposition pattern for the cost columns, so a cost written as a relative or signed token slips through even though callgrind costs are non-negative integer event counts. A file with a line like 0 -90 feeds that negative value straight into the per-function and global SAMPLES totals, which deflates the denominator and pushes the other functions well past their real share of time (and silently drops the tampered function). parse_association_spec has the same gap, taking the calls= count through a bare int(), so calls=-5 lands as a negative call tally on the node and edge.

Validate that the cost columns and the call count are non-negative integers and treat a line that violates that as unrecognized, the same way the parser already handles any other malformed line. Keeping the check inside the parser means a crafted profile cannot skew the totals before the rest of the pipeline sees them, and it matches the non-negative form the cost regex and the existing _call_re already describe.