pcre2test: fix off-by-one heap write in pattern expand buffer

[sage-mode-hunter]

The expand pattern modifier can fill pbuffer8 to its exact size and then write the terminating zero one byte past the end:

• the growth loop at pcre2test_inc.h:2292 stops once count*length fits exactly, leaving no room for the trailing NUL stored just after at :2310
• /\[a]{50000}/expand (50000 is the default pbuffer8 size) overflows the buffer by one byte; ASAN reports a heap-buffer-overflow WRITE of size 1 in process_pattern
• the subject-side \[...]{n} replicator lower in the same file already reserves the byte with >=