Fix `substr` and add `substring`

See:

 - https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/substring
 - https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/substr

Tested with:

 - node -e "console.log('hi there'.substr(3, 2))"
 - node -e "console.log('hi there'.substring(3, 5))"
Fix test for negative `substr*`start

Doc sasys "If either argument is less than 0 or is NaN, it is treated as if it were 0."
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/substring

Trusted MDN, didn't check spec itself.

Tested with:

 - node -e "console.log('test'.substr(-200))"