Before 6014912e, VRE_sub() used an
ovector of size 30, which always containted sufficient space to store
the 10 possible back- references \0 thorugh \9.

Now that we use pcre2_match_data_create_from_pattern() and later
pcre2_get_ovector_pointer(), we only get space for the number of
substrings in the pattern, see pcre2api(3):

	The ovector is created to be exactly the right size to hold
	all the substrings a pattern might capture.

Consequently, we need to check that back references do not exceed the
maximum ovector.