[6.x] Fix Comb returning 500 when matched search token is longer than the configured snippet_length

[ryanmitchell]

Fixes #12951

Background

The offending token here is backchannel_logout_session_required — exactly 35 characters. The index sets snippet_length => 30.

Chain of events:

1. Line 1080: $half = floor(($length - Str::length($chunk)) / 2) → floor((30 - 35) / 2) = -3 (negative).
2. Line 1085: Str::safeTruncateReverse($before, -3). A negative length defeats Stringy's safeTruncate — internally it does mb_substr($str, 0, $negativeLength), which keeps almost the whole string instead of trimming it. So $snippet is never bounded to snippet_length.
3. Line 1087: $surplus = Str::substr($after, Str::length($trimmed)). Because $trimmed collapses to almost nothing, $surplus ends up being nearly the full $after (~31 chars), and it gets prepended to $before on the next loop iteration
   (line 1078).
4. With the token recurring through the document (plus stemming/alternates), $snippet grows by ~one snippet-width per match — unbounded. In the reporter's content it reached ~2435 chars.
5. Line 1086: Str::safeTruncate($after, $length - Str::length($snippet)) → safeTruncate($after, 30 - 2435) = safeTruncate($after, -2405). Stringy then calls mb_strpos($after, ' ', -2406, 'UTF-8'). $after is only " : true, ... } (~14 chars), so the offset -2406 is way out of range → PHP 8's mb_strpos throws ValueError: Argument 3 ($offset) must be contained in argument 1. (On PHP 7 this only emitted a warning and returned false, so it wouldn't have 500'd.)

Why snippet_length = 35 fixed it: the token is 35 chars, so floor((35 - 35) / 2) = 0 — no longer negative, truncation works normally, $snippet stays bounded, surplus doesn't run away. Any snippet_length ≥ token length works; 34 would still break (floor(-0.5) = -1).

Fix

Although this fixes it in Comb, there is an argument that it should be fixed in Stringy instead and negative truncates get clamped to 0.