tmpl, value: accept `null` as an explicit keyword

tmpl, value: accept `null` as an explicit keyword

Adds tmpl_afrom_null_substr so the bareword `null` is recognised at
tmpl-tokenize time and builds a TMPL_TYPE_DATA wrapping an
FR_TYPE_NULL box.  Wired in before the numeric / address / bool /
attribute branches in tmpl_afrom_substr so a dictionary attribute
named "null" can't shadow it.

FR_TYPE_NULL previously doubled as the "uninitialised box" sentinel,
which is why TMPL_VERIFY panicked when it saw one inside a
TMPL_TYPE_DATA and why fr_value_box_cast_to_{string,octets} lacked
a source case for it.  With the null keyword those encounters are
now deliberate, so:

  - Drop the "FR_TYPE_NULL inside TMPL_TYPE_DATA is uninitialised"
    assertion in tmpl_tokenize.c's TMPL_VERIFY.
  - Cast FR_TYPE_NULL to an empty string / zero-length octets box.

The result is that positional xlat arguments can carry an explicit
"no value" placeholder without the framework dropping the slot or
the type system tripping over it.