[Could cause OOB read in clients] Fix incorrect positive error code from pcre2_substitute()

[NWilson]

This has minor security implications.

pcre2_substitute() calls check_escape() which returns a positive compile-error. Unfortunately, this is returned back to the pcre2_substitute() caller, which interprets a non-negative code as meaning "substitute succeeded".

This could cause the client to process the return string, assuming that it is null-terminated, and perform an out-of-bounds read.

Clients which use the *blength parameter to determine the length of the returned string are unaffected.

The pcre2test application was itself affected: it would print garbage memory because it relies on the null terminator when pcre2_substitute() returns non-negative.