fix: avoid panic in array_position start_from near i64::MIN

[SAY-5]

Which issue does this PR close?

• Closes panic: array_position underflows start_from at i64::MIN #22220.

Rationale for this change

array_position accepts an optional 1-indexed start_from argument. When resolving it, the code converts to a 0-indexed offset with a plain value - 1. For start_from = i64::MIN this subtraction overflows, which panics in debug/overflow-checked builds and wraps in release. The out-of-bounds error path also computed from + 1, which overflows the same way. An invalid start_from should return a normal error rather than panic.

What changes are included in this PR?

Use saturating_sub(1) when converting start_from to a 0-indexed offset and saturating_add(1) when reporting it back in the out-of-bounds error. A saturated i64::MIN stays negative, so the existing from >= 0 bounds check now rejects it with the usual start_from out of bounds error instead of overflowing.

Are these changes tested?

Yes. Added a unit test that invokes array_position with start_from = i64::MIN and asserts an error is returned. It panics on main and passes with this change.

Are there any user-facing changes?

array_position(..., i64::MIN) now returns an error instead of panicking. No API changes.

[xudong963]

I think the correct design is to retain the original 1-based value until it has been validated, then convert with checked arithmetic. Ideally, one shared helper should:

1. Accept the original start_from.
2. Use checked_sub(1).
3. Convert with usize::try_from.
4. Validate against the row length.
   5,Construct any error from the untouched original value.