String: fix out-of-bounds read in $' substitution expansion

[basavaraj-sm05]

Proposed changes

The $' token in a replacement string expands to the part of the subject that comes after the match. njs_string_get_substitution() builds it with njs_string_offset(&s, pos + length), where length is the character length of the matched text. pos is already clamped to the subject by every caller, but the matched length is taken as-is, and through RegExp.prototype[Symbol.replace] with a script-supplied exec() the match object's [0] can be any string, so pos + length can run well past the end of the subject. On a multibyte subject that pushes njs_string_offset() into njs_string_utf8_offset(), whose own comment notes it assumes a valid index and which reads the UTF-8 offset map without a bounds check, so the oversized index reads far outside the map. I noticed it while comparing the $' branch against the neighboring $` branch, which stays in range because it only uses the already-clamped pos. Clamping pos + length to the subject length before the offset call closes the read and matches the GetSubstitution step in the spec, where the tail starts at min(position + matchLength, stringLength).

Checklist

Before creating a PR, run through this checklist and mark each as complete:

• I have read the CONTRIBUTING document
• If applicable, I have added tests that prove my fix is effective or that my feature works
• If applicable, I have checked that any relevant tests pass after adding my changes

[github-actions]

🎉 Thank you for your contribution! It appears you have not yet signed the F5 Contributor License Agreement (CLA), which is required for your changes to be incorporated into an F5 Open Source Software (OSS) project. Please kindly read the F5 CLA and reply on a new comment with the following text to agree:

---

I have hereby read the F5 CLA and agree to its terms

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}