fix(#340): Preserve capture after hex escape

[JSap0914]

Summary

Fixes #340.

Hex escape parsing advanced one character too far, so a replacement such as $1\x00$2 consumed the $ before the second capture and produced a literal 2. Advance exactly the number of parsed hex digits instead.

Verification

• Added a focused unit regression for a character following \x00.
• Added an end-to-end replacement regression matching the issue input.
• Ran the full workspace test suite and Clippy with warnings denied.
• Confirmed the CLI emits a NUL byte immediately followed by the second capture.