json_patch: reject a move past the end of the same array

json_object_array_move_cb() added one to the array length when "from"
and "path" are in the same array, so that the old length counted as a
valid target index. A move is a remove followed by an add (RFC 6902
section 4.4), and the add's index must not be greater than the number
of elements left after the remove. With the extra slot,
json_object_array_insert_idx() was called one past the end and padded
the array with a null:

    doc:   {"foo": [1, 2, 3]}
    patch: [{"op": "move", "from": "/foo/0", "path": "/foo/3"}]

returned 0 with {"foo": [2, 3, null, 1]}. It now fails with EINVAL,
like an add to /foo/3 on a two-element array. Moving to /foo/2 or
/foo/- still puts the element last.

tests/json_patch_tests.json

@@ -136,6 +136,16 @@
       "doc": ["foo", "sil"],
       "patch": [{"op":"add", "path": "/3", "value": "bar"}],
       "error": "index is greater than number of items in array" },
+
+    { "comment": "Move within an array to the old array length is out of bounds",
+      "doc": {"foo": [1, 2, 3]},
+      "patch": [{"op": "move", "from": "/foo/0", "path": "/foo/3"}],
+      "error": "/foo/3 is past the end of the array once /foo/0 is removed" },
+
+    { "comment": "Move within an array to its last index",
+      "doc": {"foo": [1, 2, 3]},
+      "patch": [{"op": "move", "from": "/foo/0", "path": "/foo/2"}],
+      "expected": {"foo": [2, 3, 1]} },
       
     { "comment": "test integer against equal double",
       "doc": {"n": 1},