Fix bugs flagged in code review of jsonpull C++ port

- jsontool.cpp `out()`: route JSON_NUMBER (and anything else non-string)
  through `json_stringify` instead of `o->string()`, which now asserts
  on a non-string type and would crash `--extract` on numeric attributes.
- geojson.{hpp,cpp} `json_end_map`: take `json_pull_ptr` by reference so
  the caller's shared_ptr is released, null-guard before touching
  `jp->source`, and clear `jp->source` after delete to avoid a dangling
  pointer.
- jsonpull/jsonpull.cpp: low-surrogate range check was comparing the
  outer-loop byte `c` instead of the parsed code unit `ch`, breaking
  surrogate-pair decoding for some \\uXXXX escapes. Pre-existing bug
  preserved across the port.
- tile-join.cpp `handle_vector_layers`: require the field value to have
  type JSON_STRING (and the key to be non-null) before calling
  `string()`; the previous truthy `type` check would assert on a
  non-string value.

Co-authored-by: Cursor <cursoragent@cursor.com>

geojson.cpp

@@ -306,7 +306,11 @@ json_pull_ptr json_begin_map(char *map, long long len) {
 	return json_begin(json_map_read, jm);
 }
 
-void json_end_map(json_pull_ptr jp) {
+void json_end_map(json_pull_ptr &jp) {
+	if (jp == nullptr) {
+		return;
+	}
 	delete (struct jsonmap *) jp->source;
+	jp->source = nullptr;
 	json_end(jp);
 }