If the string ends with a '\', the function tried to read the next
character before checking bounds. This commit move the bounds check
before the read to avoid the out-of-bounds read.

Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21578

If the string ends with a Multiline terminator without a newline, the
function tried to read the next character to check for a newline without
checking if the pointer was past the end of the buffer. This commit adds
a bounds check and return early with an error in case of missing
newline.

Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21579

If the input contains '${' but no following '}', ucl_check_variable
should still increment out_len since ucl_expand_variable will copy the
'$' in the destination buffer.

Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24591

I believe this was the intent of the original format string, but two
characters got swapped. See printf docs at
https://www.gnu.org/software/libc/manual/html_node/Output-Conversion-Syntax.html#Output-Conversion-Syntax.

Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25626
Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33041

The strncmp call could read past the bounds of the haystack. The loop
now stop when the remaining data in the haystack cannot contain the
needle.

Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28135

If the input ends in '$', calling ucl_check_variable will result in an
out-of-bounds read.

Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34755

Keys may have null bytes, when they are decoded from json in
ucl_unescape_json_string and contain \u0000. Not copying the full key
resulted in out-of-bounds reads. The copy now relies on memcpy and
keylen instead of strdup.

Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38579
Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38675

This macro is often used in loops before checking whether the end of
chunk condition. Adding a bounds check in there prevents reading past
the buffer.

This commit improves variable expansion and adds:
- an in_len argument to the function in order to avoid reading past the
  end of the src buffer
- a check that the variable name is followed by '}' in strict mode
- extra bounds check to prevent out of bounds reads and writes