fix oob read in UTF32 LA from byte-scaled bounds check

[zayeem06]

Out-of-bounds read in the UTF-32 LA routines

The lookahead bounds check in antlr3UTF32LA, antlr3UTF32LALE and antlr3UTF32LABE compares a byte pointer advanced by la - 1, but the value it returns reads a 4-byte UTF-32 unit at index la - 1. The limit moves one byte per lookahead while the read moves four, so any LA(2) or greater near the end of a UTF-32 stream (a file opened with a UTF-32 BOM, or a UCS4 in-place stream) passes the check and reads up to four bytes past the input buffer. I scaled the check by the element size in all three functions so the whole unit at la - 1 must sit inside the buffer; the 8-bit and EBCDIC paths are single-byte and were left as-is.

I confirmed it with an ASAN reproducer built from the exact check and read against a one-code-point heap buffer: LA(2) reports a heap-buffer-overflow read of size 4 before the patch and returns EOF after it. Worth a reviewer eye on the negative-la path, which these routines still don't lower-bound, but that's pre-existing and separate from this fix.