Fix out-of-bounds read in Buffer.prototype.toString()

Fix out-of-bounds read in Buffer.prototype.toString()

Buffer.prototype.toString(encoding, start, end) on the njs engine
clamped start and end independently to the buffer length but never
enforced start <= end. With start > end the unsigned subtraction
end - start underflowed, the zero-length guard did not fire, and the
encoder read past the buffer.

Reject the start >= end case before computing the range, returning an
empty string to match Node.js semantics.

While here, add parallel missing functionality to QuickJS
for start and end arguments for Buffer.prototype.toString().