Revise Json Patch handling of the "-" token

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

Today, we handle `-` as end of list position.

https://github.com/dotnet/aspnetcore/blob/eb23a80df7a461e899535d06f5603c69090e6b08/src/Features/JsonPatch.SystemTextJson/src/Internal/ListAdapter.cs#L221-L226

https://github.com/dotnet/aspnetcore/blob/eb23a80df7a461e899535d06f5603c69090e6b08/src/Features/JsonPatch/src/Internal/ListAdapter.cs#L302-L307

This is fine, but in error cases this should be expected to surface as `JsonPatchError`, but it could surface as `IndexOutOfRangeException` instead.

- For `test` operation, we try to access the index directly (-1) without bounds check and this doesn't surface as JsonPatchError.
- For other operations, this also fails similarly when the list (json array) is empty.

### Expected Behavior

JsonPatchError is produced.