[release/10.0] Fix off-by-one error in TypePreinit switch instruction handling (#127587)

Backport of #123911 to release/10.0

/cc @agocke @sbomer

## Customer Impact

- [x] Customer reported
- [ ] Found internally

When the value exactly equals the case count, the code tried to read a
non-existent jump table entry, corrupting the IL reader offset and
causing an IndexOutOfRangeException during NativeAOT compilation.

## Regression

- [ ] Yes
- [X] No

## Testing

Unit tests

## Risk

Low

Co-authored-by: Sven Boemer <sbomer@gmail.com>

Author: github-actions[bot]

src/coreclr/tools/aot/ILCompiler.Compiler/Compiler/TypePreinit.cs

@@ -1272,7 +1272,7 @@ private Status TryScanMethod(MethodIL methodIL, Value[] parameters, Stack<Method
 
                         uint count = reader.ReadILUInt32();
                         int nextInstruction = reader.Offset + (int)(4 * count);
-                        if (target > count)
+                        if (target >= count)
                         {
                             reader.Seek(nextInstruction);
                         }

src/tests/nativeaot/SmokeTests/Preinitialization/Preinitialization.cs

@@ -813,6 +813,7 @@ class Switcher
         public static int CaseMinus1 = Switch(-1);
         public static int Case0 = Switch(0);
         public static int Case6 = Switch(6);
+        public static int Case7 = Switch(7); // Boundary: value == case count (tests fix for https://github.com/dotnet/runtime/issues/123833)
         public static int Case100 = Switch(100);
 
         private static int Switch(int x)
@@ -837,6 +838,7 @@ public static void Run()
         Assert.AreEqual(Switcher.CaseMinus1, 100000);
         Assert.AreEqual(Switcher.Case0, 100);
         Assert.AreEqual(Switcher.Case6, 700);
+        Assert.AreEqual(Switcher.Case7, 100000);
         Assert.AreEqual(Switcher.Case100, 100000);
     }
 }