toArrayBuffer: Negative-offset semantics are confusing/probably wrong

Issue flagged by Trevor here: https://github.com/anza-xyz/kit/pull/1957#pullrequestreview-4982438072

> Negative-offset semantics are murky in the slow path. buffer.slice(bytesOffset, bytesOffset + bytesLength) with a negative bytesOffset produces an end index that crosses zero (e.g. slice(-1, 0) → empty buffer), so most negative offset/length combinations return empty buffers rather than tail slices. The existing it.each tests only assert not.toBe(buffer), so they don't catch this.

It seems like this is probably not behaving as we'd expect. Should probably try to make this behave exactly the same as native `slice` in this case.