[Strings] Fix StringSlice end computation

[kripken]

The spec says

If pos is greater than the number of WTF-16 code units in view, it is as if it were instead given as the code unit length. This transformation is the "WTF-16 position treatment".

(stringview_wtf16.slice view:stringview_wtf16 start:i32 end:i32)
  -> str:stringref

Return a substring of view, for the WTF-16 code units starting at offset start and continuing to but not including end. start and end receive the "WTF-16 position treatment", as for stringview_wtf16.encode.

My understanding is that that means if the end is larger than the size, it is shrunk to the size. That is,

end = min(end, actual size)

That appears to match what V8 does, thereby fixing a fuzz bug, and also matches what JS strings do. Before, we used to trap on out of bounds here.

[tlively]

This spec has all sorts of surprises in it...