Allocator.sub should never raise exceptions
Allocator.sub should never raise exceptions

`sub` should have the sense of "subtraction" i.e. a \ b

It shouldn't be an error if a `intersection` b is empty. If a particular
user wishes to impose that constraint, they should do that themselves.
This module should be all about sets of segments (logical or physical)
i.e. sets of integers.

Signed-off-by: David Scott <63c9eb0ea83039690fefa11afe17873ba8278a56@citrix.com>

djs55/mirage-block-volume,simonjbeaumont/mirage-block-volume