Ensure variable_buffer is always nul-terminated

Ensure variable_buffer is always nul-terminated

* src/expand.c (variable_buffer_output): Allocate an extra byte and
set it to nul.  For safety, add assert() on PTR.
(variable_expand_string): Don't call variable_buffer_output just to
add a nul byte.
(allocated_variable_append): Ditto.