Fix crash on RTL caret offset before a run's first glyph

If a ligature glyph is composed across an inline boundary, the glyph
will end up getting owned by the first character (outside the boundary),
leaving the others without an owner within their run. The RTL walking
logic did not account for this (edge) case, so this change adds a simple
check to handle it, and a test that checks basic cursor validity in this
scenario (which crashes without this fix).

BUG: 472563267
Change-Id: I67e644c8f00b5541777cd41ba9dc92aed5192ac5
FIXED: 483936080
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8309212
Commit-Queue: Hoch Hochkeppel <mhochk@microsoft.com>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1690877}