fix(linter): clamp invalid JS plugin locations (#26144)

Follow-up to #26138, closes #25867.

External plugins can report a node range past the source text. The default formatter rejects that invalid span and previously panicked. Clamp external diagnostic offsets to the source's UTF-16 length before normalizing reversed ranges.

The end-to-end fixture now covers:
 - reversed locations
 - negative loc values
 - negative node ranges
 - an out-of-range node range in Unicode source text