Fix missing bounds check for character sets in bar()

[Avlaak]

Fix missing bounds check for character sets in bar()

Summary

This change fixes a bug in bar() where a character set ([...]) could be
evaluated after the input string had already been fully consumed, producing
false positive matches.

The issue was exposed by the pattern ^(-?[0-9]+[.|,][0-9]+), which
incorrectly matched plain integer inputs such as 1 and -1.

Root cause

When bar() processed a character set ([...]), it did not verify that the
current input position was still within bounds before calling match_set().

Because of that, a pattern like [.|,] could be tested against the string
terminator after the input was exhausted, which allowed the overall expression
to produce a false positive match.

Fix

The matcher now returns SLRE_NO_MATCH if a character set is reached when the
current position is already at or beyond the end of the input string.

Tests

Added regression coverage for these inputs with
^(-?[0-9]+[.|,][0-9]+):

• 1 -> no match
• 1.0 -> match
• 1,0 -> match
• -1 -> no match
• -1.0 -> match
• -1,0 -> match