Fix LuaSandbox mw.ustring.byteoffset with negative 'i'

Negative values for 'i' in mw.ustring.byteoffset are supposed to count
from the end of the string. But in LuaSandbox, it was actually counting
from two bytes before the end of the string due to a typo.

Fix that, and add some tests for it.

Bug: 50176
Change-Id: Iceee1022a55abd7a08df1ea7843e1277eb02798b