array: Fix array_remove_at() for non-pointer arrays

Because array_remove_at() or rather the called array_remove() may move
elements over the element at the currently enumerated position, simply
returning a pointer to that position for non-pointer arrays could result
in the pointer passed to enumerate() pointing to the previous or next
array element after the array_remove_at() call.  The caller would thus
operate on the wrong element if the that pointer is accessed again before
calling enumerate().

This had an impact on auth_cfg_t where purge() may optionally keep CA
certificates (which is a feature used during multiple IKEv2 authentication
rounds), but due to this bug such certificates may still have been destroyed
while the pointer to them remained in the array, which then lead to
incorrect reference counts and eventually crashes.
array: Adjust negative index before calling remove_head|tail()

For ARRAY_TAIL we most often want to call remove_tail() not remove_head().