mod_speling: avoid out-of-bounds read in check_speling

[arshsmith1]

check_speling() assumes postgood (the mapped file base name plus any PATH_INFO) is a trailing substring of r->uri, but nothing enforces that before it computes r->uri + (urlen - pglen) for the suffix compare. When a mapper such as Alias or a RewriteRule points a short URI at a nonexistent file whose base name is longer, pglen exceeds urlen, the int subtraction goes negative, and the strcmp reads before the start of the r->uri buffer (the apr_pstrndup that follows also gets a negative length). Returning DECLINED when pglen > urlen keeps the compare in bounds and leaves the normal suffix case unchanged.

AI tooling was used to help prepare this change.

[notroj]

Thanks. Any chance of a test case as well?