input: Fix panic on IME composition in `masked` input (#2623)

## Description

IME composition in a `masked` input panicked while shaping text: `end
byte index 8 is not a char boundary; it is inside '•'`.

The masked display text is `MASK_CHAR` repeated once per character, but
the IME marked range (#2601) was passed to `split_run_for_ime_underline`
in original-text offsets, so a `TextRun` boundary could land inside a
multi-byte `MASK_CHAR`. Convert it to mask offsets first, and add a
regression test on the run boundaries.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>