[sandbox] Use 32-bit offset accumulation in StringToSlice and Turboshaft

This resolves the same bug as crrev.com/c/7900075, but located within
Torque (`StringToSlice`) and Turboshaft (`MachineLoweringReducer`).
Under memory corruption, chaining sliced strings previously allowed
64-bit slow-path slice offset accumulation to exceed 32 bits or
underflow, enabling out-of-sandbox string reads.

This CL applies the same 32-bit truncation fix used in
`ToDirectStringAssembler` to both locations, ensuring that corrupted
accumulated offsets wrap around safely within 4 GB and land inside the
sandbox or its guard regions.

TAG=agy
CONV=6ac5b6a9-3e41-42fa-b5a7-4f7744db9a36

Bug: 519768343, 522397420
Change-Id: I3f3e18327b5908efc4b43f3c16fd638e75f60104
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7926028
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#107927}