Fix start_pos() for strings containing escape sequences (#5361)

The diagnostic position of a string value was derived by subtracting the
parsed value's length from the end position. Escape sequences make the
source token longer than the value it parses to, so the reported start
position landed inside the string, one byte off per escape sequence:

    input: {"a":"\n\n\n\n\n\n"}
      start_pos() == 11, so the reported range covered  n\n\n\n"
      instead of the documented "\n\n\n\n\n\n"

This contradicts the documented behavior of start_pos(), which is the
position of the opening quote, and it also corrupted the "(bytes N-M)"
part of JSON_DIAGNOSTICS exception messages. Strings with multi-byte
UTF-8 but no escapes were unaffected, which is why this went unnoticed.

Record the offset of the token in the lexer when it starts scanning and
use that, instead of reconstructing it from the parsed value. Booleans,
null and numbers already reported correct positions and are unchanged.

The new lexer member and accessor are compiled only when
JSON_DIAGNOSTIC_POSITIONS is enabled, which is already part of the ABI
tag, so the default build is unaffected.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

tests/src/unit-diagnostic-positions.cpp

@@ -38,6 +38,36 @@ TEST_CASE("Better diagnostics with positions")
                              "[json.exception.type_error.302] type must be number, but is string", json::type_error);
     }
 
+    SECTION("positions of strings containing escape sequences")
+    {
+        // escape sequences make the token longer than the string it parses to,
+        // so the positions must not be derived from the parsed value's length
+        const auto check = [](const std::string & text, const std::string & token)
+        {
+            CAPTURE(text)
+            CAPTURE(token)
+            const json j = json::parse(text);
+            const json& v = j.at("a");
+            CHECK(text.substr(v.start_pos(), v.end_pos() - v.start_pos()) == token);
+        };
+
+        check(R"({"a":"plain"})", R"("plain")");
+        check(R"({"a":"tab\there"})", R"("tab\there")");
+        check(R"({"a":"\n\n\n\n\n\n"})", R"("\n\n\n\n\n\n")");
+        check(R"({"a":"\""})", R"("\"")");
+        check(R"({"a":"\\"})", R"("\\")");
+        check(R"({"a":"é"})", R"("é")");
+        check(R"({"a":"🌞"})", R"("🌞")");
+        check("{\"a\":\"\xc3\xa9\"}", "\"\xc3\xa9\"");  // multi-byte UTF-8, no escapes
+
+        // a string at the root, where an escape would otherwise push the
+        // reported start position past the opening quote
+        const std::string root = R"("a\tb")";
+        const json j = json::parse(root);
+        CHECK(j.start_pos() == 0);
+        CHECK(j.end_pos() == root.size());
+    }
+
     SECTION("JSON patch add to primitive parent (#4292)")
     {
         // the JSON Patch "add" target /foo/bar/baz has a string parent