xfs_repair: fix bag memory overwrite problems

xfs_repair: fix bag memory overwrite problems

There's an off by one error in the bag_remove code such that we end up
copying memory from beyond the end of the array into the array.  Not a
serious problem since we have counters to prevent us from reading that
garbage, but AddressSanitizer complained so let's fix it.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>