fix: check bounds using rune array instead of string len in substring

[onelson]

Inputs that contain non-breaking spaces (NBSP), and assumedly a host of
other unicode characters caused strings.substring to panic when it
tried to index into an array of runes taken from a (seemingly larger)
string.

Failures looked like:

panic: runtime error: slice bounds out of range [:33] with capacity 32

This only seemed to panic when the inputs were "of a certain size" and
I'm not sure why that would be. Perhaps there are distinct thresholds
where the input causes the capacity to be just close enough to the
actual size of the rune count, but less than the string length in bytes.
Not sure.

The testcase added used an input seen in the wild and panicked prior to
the code change to substring.

Checklist

Dear Author 👋, the following checks should be completed (or explicitly dismissed) before merging.

• ✏️ Write a PR description, regardless of triviality, to include the value of this PR
• 🔗 Reference related issues
• 🏃 Test cases are included to exercise the new code
• 🧪 If new packages are being introduced to stdlib, link to Working Group discussion notes and ensure it lands under experimental/
• 📖 If language features are changing, ensure docs/Spec.md has been updated

Dear Reviewer(s) 👋, you are responsible (among others) for ensuring the completeness and quality of the above before approval.

[wolffcm]

Looks good. I had a comment about how this function is registered (it was a little inconsistent before you got here)