lavc/vvc: Stricter bound on pps_exp_slice_height_in_ctus_minus1

When pps_num_exp_slices_in_tile[i] is nonzero, the ith tile is made up
of pps_num_exp_slices_in_tile[i] slices stacked atop one another, where
the height of the jth slice in the ith tile is given by
pps_exp_slice_height_in_ctus_minus1[i][j].  The sum of the heights of
the slices in the tile should not exceed the height of the tile itself.

Signed-off-by: Frank Plowman <post@frankplowman.com>

libavcodec/cbs_h266_syntax_template.c

@@ -2020,7 +2020,7 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,
                         for (j = 0; j < current->pps_num_exp_slices_in_tile[i];
                              j++) {
                             ues(pps_exp_slice_height_in_ctus_minus1[i][j], 0,
-                                current->row_height_val[tile_y] - 1, 2,
+                                remaining_height_in_ctbs_y - 1, 2,
                                 i, j);
                             slice_height_in_ctus =
                                 current->