ReaderBaseJsonParser._verifyRootSpace() can cause buffer boundary failure

[cowtowncoder]

(note: found by OSS-Fuzzer: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52688)

Looks like there is a very rare condition on which _verifyRootspace() of ReaderBasedJsonParser (and possibly other backends) can cause a number String override. This requires:

1. Root-level (integer) number read
2. Input buffer ends with \r character
3. There is enough content to be read to overwrite end of input buffer where number is fully contained

if so we can observe an "interesting" parse failure.

This is rather complicated to reproduce and test but I was able to do so for reader-based reader.

[cowtowncoder]

NOTE: looks like byte-backed source is not affected since this relies on shared input buffer handling which is only available for char-backed sources.