Clamp OnesBetween to the bitset length

OnesBetween indexed b.set from to>>6 without a bounds check, so any to
past Len() read off the end of the slice. Test, Rank and GetWord64AtBit
all clamp; this one did not.