utcToZonedTime bug with the end hour of dst

**Describe the bug**

```js
const d = dayjs('1986-9-14 01:00:00');
const d1 = d.tz('Asia/Shanghai');
console.log(d1.valueOf());
const d2 = d1.add(1, 'hour').tz('Asia/Shanghai');
console.log(d2.valueOf());
console.log(dayjs().utcOffset());
```

The d2 is after d1 `1 hour`, but the output is same:

```
d1 527011200000
d2 527011200000
```

**Expected behavior**

`d2.vavlueOf()` need to be `527011200000 + 60 * 60 * 1000`

**Information**
- Day.js Version [1.11.1]
- OS: [Mac]
- Browser [Chrome 100.0.4896.88]
- Time zone: [Asia/Shanghai]

Start by running the supplied reproduction with Day.js 1.11.1, focusing on the d.tz and d1.add(1, 'hour').tz calls for Asia/Shanghai on the DST boundary. Trace the timezone handling used by these calls and compare the resulting valueOf() values with the expected one-hour increase. Done means d2.valueOf() is 527014800000 for the reported case.

Written by the indexing model from the issue text.