[GIT-PULLS] [php-src] PR #23499: [mbstring] Fix mb_ereg_replace() emitting NUL/garbage for unterminated \k<name>

Pull Request: https://github.com/php/php-src/pull/23499
Author: iliaal

When a `\k<name>` backreference in an mb_ereg_replace() replacement string lacks its closing delimiter, the verbatim copy of the escape sequence measured its length from a pointer one past the string end and embedded the trailing NUL terminator in the replacement output, and the multibyte scan of the name after `\k` could equally read heap bytes beyond the string end. Both copy lengths are now clamped to the string end, so neither runs past the parsed name. A regression test covers the unterminated-name and multibyte cases.