Fix xstrndup() documentation, callers. Disclosed implementation bugs.

Fix xstrndup() documentation, callers. Disclosed implementation bugs.

xstrndup() does not work like strndup(3), and some callers got confused:

1. When n is the str length or less, standard strndup(str,n) copies all
   n bytes but our xstrndup(str,n) drops the last one. Thus, all callers
   must add one to the desired result length when calling xstrndup().
   Most already do, but it is often hard to see due to low code quality
   (e.g., one must remember that MAX_URL is not the maximum URL length).

2. xstrndup() also assumes that the source string is 0-terminated. This
   dangerous assumption does not contradict many official strndup(3)
   descriptions, but that lack of contradiction is actually a recently
   fixed POSIX documentation bug (i.e., correct implementations must not
   assume 0-termination): http://austingroupbugs.net/view.php?id=1019

The OutOfBoundsException bug led to truncated exception messages.

The ESI bug led to truncated 'literal strings', but I do not know what
that means in terms of user impact. That ESI fix is untested.

cachemgr.cc bug was masked by the fact that the buffer ends with \n
that is unused and stripped by the custom xstrtok() implementation.

TODO. Fix xstrndup() implementation (and rename the function so that
fixed callers do not misbehave if carelessly ported to older Squids).