fix out-of-bounds read in mod_proxy_html metafix

[arshsmith1]

metafix scans the backend response buffer for a header name and content value, but buf comes straight from apr_bucket_read and is not NUL terminated while the scans have no bound against buf+len. A backend body whose tag lands at the end of the bucket (with ProxyHTMLMeta on) walks past the buffer, reading adjacent heap and copying it into a response header name. Bound every scan in metafix to buf+len so a tag at the buffer boundary stops cleanly.