[wks]

The old constant MAX_SPACES = 16 made space index calculation complicated. We fix this by defining the number of bits in the space index (SPACE_INDEX_BITS), then derive SPACE_INDEX_LIMIT which is the limit of (strictly greater than) valid space indices, and MAX_SPACES which is the max valid space indices. Now MAX_SPACES is 15 which is the highest value that can be represented with 4 bits.

We modified SFTSpaceMap so that SFTSpaceMap::sft now has exactly SPACE_INDEX_LIMIT elements instead of deriving the length from Address::MAX. addr_to_index now returns Option<usize> and returns None if an address cannot be mapped to a valid space index.