uint64_t underflow inside Array::arrayPrototypeSplice

## Bug Description

Incorrect handling of unsigned variables causes an undeflow inside `Array::arrayPrototypeSplice` when calling `array.splice(0)`. This leads to a missed call to DeleteProperty on array elements.

https://github.com/facebook/hermes/blob/657380912e05dda0dda49a9e1204f9166442d737/lib/VM/JSLib/Array.cpp#L2698

If `len == actualDeleteCount` (as for `array.splice(0)`) result expression `< 0` for `uint64_t` and the loop never executes.

- [x] I have run `gradle clean` and confirmed this bug does not occur with JSC
- [x] The issue is reproducible with the latest version of React Native.

Hermes git revision (if applicable): https://github.com/facebook/hermes/commit/896ee1e4377bc81823212a4abdef482d659948b1

## Steps To Reproduce

An example with Proxy, which is a symptom:

```js
let log = (...args) => typeof print === 'undefined' ? console.log(JSON.stringify(args)) : print(JSON.stringify(args))

let arr = new Proxy([], {
deleteProperty(target, p) {
log('del', target, p)
return Reflect.deleteProperty(target, p)
},
})

arr.push('a', 'b', 'c')
arr.splice(0)
```

Hermes
```js
no messages
```

V8
```
["del",["a","b","c"],"2"]
["del",["a","b",null],"1"]
["del",["a",null,null],"0"]
```

Start in lib/VM/JSLib/Array.cpp at Array::arrayPrototypeSplice near line 2698, then run the Proxy reproduction with array.splice(0). Check the unsigned loop-bound calculation and verify that the fix causes deleteProperty to be invoked for indices 2, 1, and 0, matching the V8 output.

Written by the indexing model from the issue text.