fix: correct buffer size in string subscript operator to prevent off-by-one allocation

The `string_subscript` native was allocating a 2-byte buffer for single-character
results, causing a one-byte over-allocation. Changed to allocate exactly 1 byte
for the character plus the null terminator handled by `wrenNewUninitializedString`.

Also fixed `wrenNewUninitializedString` to properly cast the `length` parameter
to `int` when assigning to `ObjString->length`, resolving a potential
truncation warning on 64-bit systems.

Added a test case to verify that subscript access returns a properly formed
string that compares equal to the expected character.

test/string/subscript.wren

@@ -9,3 +9,6 @@ IO.print("abcd"[-4]) // expect: a
 IO.print("abcd"[-3]) // expect: b
 IO.print("abcd"[-2]) // expect: c
 IO.print("abcd"[-1]) // expect: d
+
+// Make sure the string's internal buffer size is correct.
+IO.print("abcd"[1] == "b") // expect: true