CFPropertyList: fix out-of-bounds reads and an invalid free

[DTW-Thalion]

The OpenStep property-list parser scans a UTF-16 buffer that is not NUL-
terminated (limit = buffer + count), yet several loops advance the cursor
and then dereference it without checking the limit:

• CFPlistStringSkipWhitespace() ran its "//" and "/* */" comment loops
  with "do { cursor++; ch = *cursor; } while (ch)", relying on a
  terminator that does not exist, and read one past the end after
  advancing for whitespace and the leading '/';
• CFOpenStepPlistParseString() read one past the end after a backslash
  escape and while scanning an unquoted string;
• CFOpenStepPlistParseObject() read *cursor when testing for the closing
  '}' / ')' of a dictionary or array;
• CFOpenStepPlistParseData() read one past the end while collecting hex
  bytes.

A property list larger than the 1024-character internal buffer is decoded
into a separately allocated buffer, so these are real out-of-bounds heap
reads (AddressSanitizer: heap-buffer-overflow in
CFPlistStringSkipWhitespace for a "//" comment with no trailing newline).

Add a small CFPlistStringPeek() helper that returns 0 at or past the end
of the buffer and use it for every unguarded read, so the scans stop at
the end of the data instead of running past it.

Also fix the cleanup of that separately allocated buffer: it was freed
only on the failure path, and it freed "tmp" -- which
GSUnicodeFromEncoding had advanced to the end of the buffer -- rather than
the allocation base "start". Free "start" on every path (the parser
copies anything it keeps).

Adds regression tests for a large string and a comment-only list.