CVE-2026-91057: Out-of-bounds read when a multi-line text view string ends with a carriage return

gxmultilinetextviewdisplayinfoget() reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (\r). The over-read can also cause callers to advance their index past the end of the string, producing a second over-read in gxmultilinetextviewstringtotalrowscompute() and a row of text that is not in the source.