The bug was that exclusive ranges ending in zero would be converted to
end on `-1`, which would be interpretted as the last value in the range.

This maybe isn't actually documented very well (or at all...) but most
SequenceSet transform methods return a frozen result when +self+ is
frozen and a mutable result when +self+ is mutable.  Except +limit+
which always returns a frozen result.  And (before this commit) +slice+,
which inconsistently returned with matching frozen status when the
result wasn't empty, but always returned a frozen set when the result
_was_ empty.

Adding these tests exposed a much more significant bug:
`SequenceSet#xor` mutates the reciever.

`set ^ other` and `set.xor other` are supposed to be safe transforms.
But, unfortunately, they modified the receiver if it wasn't frozen, and
crashed when it was!

The fix is trivial: convert `self` to `dup`.

The goal is for `#[]` (aliased as `#slice`) to behave similarly to
`Array#[]`/`Array#slice`.  When `Array#slice` has a length or range that
extends beyond the end of the array, they simply return everything
up to the end.