buffer: accept negative indices in Buffer#slice()

A negative start or end parameter now indexes from the end of the
buffer. More in line with String#slice() and ArrayBuffer#slice().