Fix out-of-bounds access when searching arrays

Reported by Coverity.

All arrays in this code have the size Num... - 1, so accessing the entry
at Num... - 1 is out of bounds. Since we don't dereference the value,
and only use the address of the entry "one past the last" like an end-
iterator, this does not actually access out-of-bounds memory. However,
this code does rely on undefined behavior.

Use pointer arithmetics instead to get the address of the entry "one
past the last", which is well defined behavior and should satisfy
Coverity.

Change-Id: Ie5fbb2da080d6118169f35056763b5d95cfeda62
Fixes: QTBUG-83817
Coverity-Id: 183557
Pick-to: 5.15
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Andrei Golubev <andrei.golubev@qt.io>

src/gui/text/qcssparser.cpp

@@ -362,7 +362,7 @@ static bool operator<(const QCssKnownValue &prop, const QString &name)
 
 static quint64 findKnownValue(const QString &name, const QCssKnownValue *start, int numValues)
 {
-    const QCssKnownValue *end = &start[numValues - 1];
+    const QCssKnownValue *end = start + numValues - 1;
     const QCssKnownValue *prop = std::lower_bound(start, end, name);
     if ((prop == end) || (name < *prop))
         return 0;