Fix undefined double-to-int cast in lexer_construct_number_object (#5304)

[1820893135-pixel]

lexer_construct_number_object() tries to fold a numeric literal into a
CBC_PUSH_NUMBER_BYTE_RANGE immediate by casting the parsed double to
int32_t and then checking whether the cast round-trips (js-lexer.c:2539):

int32_t int_num = (int32_t) num;

if (int_num == num && int_num <= CBC_PUSH_NUMBER_BYTE_RANGE_END && ...)

For a literal outside the int32_t range the cast itself is already undefined
behaviour - the comparison afterwards is too late to guard it. Under
-fsanitize=undefined (the OSS-Fuzz configuration) it traps:

js-lexer.c:2539:25: runtime error: 1e+308 is outside the range of representable
values of type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior js-lexer.c:2539:25

The trigger is plain, valid JavaScript - no malformed input involved:

var a = 1e308;

Reachable through jerry_parse / jerry_eval, so any embedder that evaluates
untrusted source deterministically aborts a UBSan build.

Fix

Move the range test in front of the cast:

if (is_expr && num >= (ecma_number_t) INT32_MIN && num <= (ecma_number_t) INT32_MAX)
{
  int32_t int_num = (int32_t) num;
  ...
}

Literals outside the range simply take the float path, which is exactly what
already happened for every value the fold did not apply to.

Testing

Adds tests/jerry/number-literal-range.js covering literals on both sides of
the boundary. On an unpatched -fsanitize=undefined build the new file aborts
with the report above; with the fix it passes.

Fixes #5304.