msodde: Fix detecting DDE in the nested field.

[kijeong]

Hello.

I checked DDE in some malware .doc samples and found a malware doc that contained DDE but was not detected by the msodde.

I did a little research and It was because it nested.
It means, A field can contain another.

So I fixed that when DDE is detected, it collects characters in the buffer until it meets the END symbol, even if there's another BEGIN symbol in the middle.

I made a sample like this with the MS Office 365 Word.
(version: Microsoft® Word Microsoft 365 MSO(Version 2301 Build 16.0.16026.20196) 64bit, Korean)

ref:

1. [MS-DOC] 2.8.25 PlcFld
   Field = <Begin> *<Field> [Sep] *<Field> <End>

thanks