Pointer::strip_prefix can return a malformed &Pointer, leading to invalid UTF-8 &str #131

Pointer::strip_prefix removes prefix as a string prefix and passes the remainder to new_unchecked. The safety comment says this preserves token boundaries, but it only does when the prefix ends where a token ends. A prefix that ends partway through a token leaves a remainder without a leading /, which is not a valid JSON Pointer.

The range PointerIndex impls in pointer/slice.rs then calculate token offsets over that malformed pointer and call from_utf8_unchecked. The offsets can fall inside a multi-byte character, which produces a &str holding invalid UTF-8 from safe code alone.

Reproduction (tested with jsonptr 0.7.1, but strip_prefix is unchanged on main):

use jsonptr::Pointer;

fn main() {
    let ptr = Pointer::from_static("/fooaé/x");
    let prefix = Pointer::from_static("/foo");

    let rest = ptr.strip_prefix(prefix).unwrap();
    println!("rest = {:?}", rest.as_str()); // "aé/x" - no leading '/'

    let head = rest.get(..1).unwrap();
    let bytes = head.as_str().as_bytes();
    println!("head bytes = {bytes:02x?}");  // [61, c3]
    println!("valid utf-8: {}", core::str::from_utf8(bytes).is_ok()); // false
}

[61, c3] ends with a lead byte that has no continuation byte. A &str like that is undefined behavior as soon as anything relies on the UTF-8 invariant, for example chars().