buffer: fix sign overflow in `readUIn32BE`

`|` operation takes precendence on `+`, which will result in
`new Buffer('ffffffff', 16).readUInt32BE(0)` returning `-1` instead of
`ffffffff`.