CFData: fix CFDataReplaceBytes length miscalculation (heap overflow)

[DTW-Thalion]

Summary

CFDataReplaceBytes computes the new buffer length as
range.location + newLength, which ignores the bytes after the replaced
range. When a replace or delete leaves a non-empty tail, the buffer is grown
too small and the subsequent tail memmove writes past the allocation
(heap buffer overflow), and the stored length is wrong (the tail is dropped).

This affects CFDataReplaceBytes, CFDataDeleteBytes, and any replace that
leaves trailing bytes — ordinary CFMutableData usage.

Reproduction (AddressSanitizer)

CFMutableDataRef d = CFDataCreateMutable(NULL, 0);
UInt8 a[20]; CFDataAppendBytes(d, a, 20);            /* length 20 */
UInt8 b[30]; CFDataReplaceBytes(d, CFRangeMake(2,3), b, 30);
/* correct new length = 20 - 3 + 30 = 47 */

• Before: ASan reports heap-buffer-overflow WRITE of size 15 in memmove
  via CFDataReplaceBytes (the buffer is grown to only 32 bytes in
  CFDataCheckCapacityAndGrow); CFDataGetLength returns 32 instead of 47.
• After: length 47, no overflow.

Fix

Compute the new length as _length - range.length + newLength, and base the
range precondition (assert) and the tail-move guard on _length rather than
_capacity / the miscomputed length.

Test

Tests/CFData/replacebytes.m covers a middle grow and a middle delete,
asserting both the resulting length and that the prefix/tail are preserved.