fix an off-by-one error: re.backref() / vmod_backref returned the trailing

null byte of the back reference copy to the workspace, so any data from
following workspace allocations could appear to be appended to the return
value of re.backref() / vmod_backref.

src/vmod_re.c

@@ -306,7 +306,7 @@ vmod_backref(struct sess *sp, struct vmod_priv *priv_vcl, int refnum,
 		WS_Release(sp->wrk->ws, 0);
 		return fallback;
 	}
-	WS_Release(sp->wrk->ws, s);
+	WS_Release(sp->wrk->ws, s + 1);
 	return substr;
 }