CFArray: fix heap overflows in mutable-array growth and copy

[DTW-Thalion]

Three related out-of-bounds heap writes, all reachable from the public
API and all confirmed with AddressSanitizer:

• CFArrayCheckCapacityAndGrow() always grew the backing store by exactly
  DEFAULT_ARRAY_CAPACITY (16), ignoring the requested capacity. An
  operation needing more than 16 additional slots at once therefore left
  the array too small and the subsequent insert wrote past the end (e.g.
  CFArrayAppendArray() of 40 elements).

• CFArrayReplaceValues() computed the new size and the move count from
  array->_count after it had already subtracted range.length, so the
  grow request was too small and the memmove copied range.length too
  many elements (an out-of-bounds read on removal). It also kept using
  the pre-grow "start" pointer, writing into the old buffer after a
  reallocation.

• CFArrayCreateMutableCopy() wrote the source contents straight into the
  new array's buffer but, on the non-Objective-C path, never enlarged
  the requested capacity to the source count (the Objective-C path does)
  -- so copying 20 elements with a requested capacity of 0 overran the
  16-slot default buffer.

Grow to at least the requested capacity; capture the original count and
recompute "start" after the grow in CFArrayReplaceValues so the size, the
move count, and the destination pointer are all correct; and clamp the
mutable-copy capacity to the source count. Adds regression tests.

[DTW-Thalion]

Some extra evidence for this one, in case it is useful for review.

Minimal repro — append past the initial 16-slot capacity of a mutable array:

#include <CoreFoundation/CFArray.h>
#include <stdio.h>

int main (void)
{
  CFMutableArrayRef a = CFArrayCreateMutable (NULL, 0, NULL);
  CFIndex i;
  for (i = 0; i < 40; i++)
    CFArrayAppendValue (a, (const void *)(CFIndex)(i + 1));
  printf ("count=%ld last=%ld\n",
          (long)CFArrayGetCount (a),
          (long)(CFIndex)CFArrayGetValueAtIndex (a, 39));
  CFRelease (a);
  return 0;
}

Built and run against an AddressSanitizer build of the library.

On master it aborts:

==ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 8 ...
    #0 CFArrayReplaceValues Source/CFArray.c:688
    #1 CFArrayAppendValue   Source/CFArray.c:575
0x... is located 0 bytes after 128-byte region [...]   (16 pointers = the old buffer)
freed by thread T0 here:
    ... realloc
    #3 CFArrayCheckCapacityAndGrow Source/CFArray.c:451
    #4 CFArrayReplaceValues        Source/CFArray.c:667
previously allocated by thread T0 here:
    #3 CFArrayCreateMutable Source/CFArray.c:481

That is exactly the case this PR addresses: start is computed from _contents before CFArrayCheckCapacityAndGrow reallocs (and frees) the buffer, so the insert loop writes one past the freed 16-pointer block. On a normal (non-ASan) build the appended value is silently lost — it lands in the freed buffer while the new slot stays uninitialized.

With this PR applied, the same repro is clean:

count=40 last=40