Fix bugs flagged in code review of jsonpull C++ port

- jsontool.cpp `out()`: route JSON_NUMBER (and anything else non-string)
  through `json_stringify` instead of `o->string()`, which now asserts
  on a non-string type and would crash `--extract` on numeric attributes.
- geojson.{hpp,cpp} `json_end_map`: take `json_pull_ptr` by reference so
  the caller's shared_ptr is released, null-guard before touching
  `jp->source`, and clear `jp->source` after delete to avoid a dangling
  pointer.
- jsonpull/jsonpull.cpp: low-surrogate range check was comparing the
  outer-loop byte `c` instead of the parsed code unit `ch`, breaking
  surrogate-pair decoding for some \\uXXXX escapes. Pre-existing bug
  preserved across the port.
- tile-join.cpp `handle_vector_layers`: require the field value to have
  type JSON_STRING (and the key to be non-null) before calling
  `string()`; the previous truthy `type` check would assert on a
  non-string value.

Co-authored-by: Cursor <cursoragent@cursor.com>

jsontool.cpp

@@ -148,9 +148,13 @@ void out(std::string const &s, int type, json_object_ptr properties) {
 		json_object_ptr o = json_hash_get(properties, extract);
 		if (o != nullptr) {
 			found = true;
-			if (o->type == JSON_STRING || o->type == JSON_NUMBER) {
+			if (o->type == JSON_STRING) {
 				extracted = sort_quote(o->string().c_str());
 			} else {
+				// Numbers, booleans, null, and any other non-string
+				// values are rendered via json_stringify(); calling
+				// o->string() here would assert because the type-tagged
+				// accessor requires JSON_STRING.
 				extracted = sort_quote(json_stringify(o).c_str());
 			}
 		}