fix: off-by-one in decode_pointer_inplace for ~1 escape sequence

[ctonneslan]

Summary

Fixes an off-by-one bug in decode_pointer_inplace() where the ~1 escape sequence writes the decoded / to the wrong position, corrupting JSON Pointer paths during patch application.

Bug

// ~0 case: correct — writes to current output position
decoded_string[0] = '~';

// ~1 case: BUG — writes to next position instead of current
decoded_string[1] = '/';  // should be decoded_string[0]

This causes JSON Pointer paths containing ~1 (encoded /) to be decoded incorrectly. For example, a patch targeting "a/b" (encoded as "a~1b") would corrupt the key to "a~/" instead of "a/b".

Fix

- decoded_string[1] = '/';
+ decoded_string[0] = '/';

Consistent with the ~0 case on line 373.

Fixes #977