tree-wide: use newa() instead of alloca() wherever we can

Typesafety is nice. And this way we can take benefit of the new size
assert() the previous commit added.

(cherry picked from commit 6e9417f5)

I just dropped the conflicting files.