Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

Same panic class as GHSA-m5j3-4634-c2vq and GHSA-m6xr-fvfg-5g64, sister site on the same function. Trigger is any selector ending in whitespace: `dasel query 'a '` panics at `selector/lexer/tokenize.go:60`. The whitespace-skip loop right above (lines 55-57) advances `p.i` to `p.srcLen` when the input is all-whitespace or whitespace-trailing. The very next line reads `p.src[p.i]` without a bounds check. ## Vulnerable code `selector/lexer/tokenize.go:53-74` (v3.11.0): ```go func (p *Tokenizer) parseCurRune() (Token, error) { // Skip over whitespace for p.i < p.srcLen && unicode.IsSpace(rune(p.src[p.i])) { p.i++ } // Skip over comments if p.src[p.i] == '/' && p.i+1 < p.srcLen && p.src[p.i+1] == '/' { // ... ``` Lines 69-71 right below already do the bounds check after the comment-skip path. The whitespace-only path slipped past it. ## Reproduce ``` $ echo '{"a":1}' | dasel query -i json 'a ' panic: runtime error: index out of range [2] with length 2 goroutine 1 [running]: github.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).parseCurRune(...) selector/lexer/tokenize.go:60 github.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).Next(...) github.com/tomwright/dasel/v3/selector/lexer.(*Tokenizer).Tokenize(...) github.com/tomwright/dasel/v3/selector.Parse(...) github.com/tomwright/dasel/v3/execution.ExecuteSelector(...) ``` Other inputs that hit it: `' '`, `$'a\t'`, `$'a\n'`, `'a ?? '`, `'a + '`. Any token (or no token) followed by whitespace. Reachable directly from the libra