HighlightedLabel would crash the application if any provided highlight
index was invalid. In theory, this should never happen. In practice,
this can happen due to race conditions at call sites.

After this change, we only panic in debug builds. In release builds, we
log an error and return a label with no highlights. The error message
includes the call site so that it's easier to fix the root cause.

Related to #57290

Part of FR-11.

Release Notes:

- N/A