util/token.h: fix possible out-of-bounds read

The 'WHITESPACE' case of the _calc_len method wrongly accessed the
character before checking upper bound of the token. The problem is fixed
by switching the order of both conditions.

Fixes #3756

repos/gems/run/depot_autopilot.run

@@ -723,6 +723,7 @@ set default_test_pkgs {
 	test-terminal_crosslink
 	test-timer
 	test-tls
+	test-token
 	test-trace
 	test-trace_logger
 	test-utf8