Introduce `splice_buffer!` abstraction for IOBuffer

Behaves just like `splice!` for arrays, except that it accepts 0-indexed positions and keeps the cursor position stable with the text. Minor behavior change to kill_line -- when killing just a newline, that goes into the buffer.