Fix potential underrun with annotation merging

As raised in JuliaLang#54860, when writing to an AnnotatedIOBuffer, should the
new content have more annotations than the AnnotatedIOBuffer, we may
attempt to index non-existent annotations.

This bug occurs in the process of looking for runs of matched
annotations. Since it is impossible for a run to be longer than the
number of existing annotations, we can add this as a sanity check and
not bother trying to check for run lengths where this is not the case.

Reported-by: caleb-allen <caleb.e.allen@gmail.com>

base/strings/annotated.jl

@@ -593,6 +593,7 @@ function _insert_annotations!(io::AnnotatedIOBuffer, annotations::Vector{Tuple{U
         for i in reverse(axes(annotations, 1))
             annot = annotations[i]
             first(first(annot)) == 1 || continue
+            i <= length(io.annotations) || continue
             if last(annot) == last(last(io.annotations))
                 valid_run = true
                 for runlen in 1:i

test/strings/annotated.jl

@@ -213,6 +213,12 @@ end
         @test write(aio2, Base.AnnotatedChar('c', [:b => 2, :c => 3, :d => 4])) == 1
         @test Base.annotations(aio2) == [(1:2, :a => 1), (1:3, :b => 2), (3:3, :c => 3), (3:3, :d => 4)]
     end
+    let aio2 = Base.AnnotatedIOBuffer()
+        @test write(aio2, Base.AnnotatedChar('a', [:b => 1])) == 1
+        @test write(aio2, Base.AnnotatedChar('b', [:a => 1, :b => 1])) == 1
+        @test read(seekstart(aio2), Base.AnnotatedString) ==
+            Base.AnnotatedString("ab", [(1:1, :b => 1), (2:2, :a => 1), (2:2, :b => 1)])
+    end
     # Working through an IOContext
     aio = Base.AnnotatedIOBuffer()
     wrapio = IOContext(aio)