[php-src] PR #23499: [mbstring] Fix mb_ereg_replace() emitting NUL/garbage for unterminated \k<name>

Pull Request: https://github.com/php/php-src/pull/23499 Author: iliaal When a \k<name> backreference in an mb_ereg_replace() replacement string lacks its closing delimiter, the verbatim copy of the escape sequence measured its length from a pointer one past the string end and embedded the trailing NUL terminator in the replacement output, and the multibyte scan of the name after \k could equally read heap bytes beyond the string end. Both copy lengths are now clamped to the string end, so neither runs past the parsed name. A regression test covers the unterminated-name and multibyte cases.