`<string>`: `basic_string::replace` fails under ASan when `pos + count > size`, and `count2 < count`

[strega-nil-ms]

#include <string>

int main()
{
  std::string t = "0123456789ABCDEF"; // large string
  t.replace(0, 30, 7, 'A'); // Address Sanitizer Error: Container overflow.
}

Looks like we (I) screwed up the logic here.

Reported in DevCom-10369462