Validate the 'section' argument passed into /course/modedit.php

When a user adds a new course module to a course using mod chooser, the URL to create the new cm looks like this (in this case adding a book to section 1):

/course/modedit.php?add=book&type=&course=8&section=1&return=0&sr=0

The 'section' argument here is expected to be a section number (e.g. the 3rd topic in the course is section number 3) and not a section id (i.e. the id of the section in the course_sections table which could be a very high value).

At present we do not validate whatever is passed in. So, if the URL includes a very high value (let's say a section id is passed in of 10000, instead of a section number 1) we get undesirable behaviour / create lots of empty sections in course.

To avoid this we can check whatever is passed in against the course format's get_max_sections() value, and reject any value exceeding it.

It's a minor security issue in that, without the fix, it seems users are given a route to add new sections in excess of the limits provided.

Proposed fix attached