fix VSM_map mmap length for real

I got this wrong in 69695c23 for the
case that the segment spans two pages.

Ref: #2541

mmaps from b25.vtc varnishstat:

before this change:

6598  open("/tmp/vtc.6492.2b3b5875/v1//_.vsm_child/_.VSC_cluster.322833fd50de0860", O_RDONLY) = 21
6598  mmap(NULL, 4096, PROT_READ, MAP_SHARED, 21, 0) = 0x7fb92529e000
...
6598  open("/tmp/vtc.6492.2b3b5875/v1//_.vsm_child/_.VSC_cluster.322833fd50de0860", O_RDONLY) = 21
6598  mmap(NULL, 8192, PROT_READ, MAP_SHARED, 21, 0) = 0x7fb925271000
...
6598  open("/tmp/vtc.6492.2b3b5875/v1//_.vsm_child/_.VSC_cluster.322833fd50de0860", O_RDONLY) = 21
6598  mmap(NULL, 12288, PROT_READ, MAP_SHARED, 21, 0x1000) = 0x7fb925222000
...
6598  open("/tmp/vtc.6492.2b3b5875/v1//_.vsm_child/_.VSC_cluster.322833fd50de0860", O_RDONLY) = 21
6598  mmap(NULL, 12288, PROT_READ, MAP_SHARED, 21, 0x2000) = 0x7fb92521f000

after this change:

7749  open("/tmp/vtc.7648.2c3869d9/v1//_.vsm_child/_.VSC_cluster.09720dc34dd3559c", O_RDONLY) = 21
7749  mmap(NULL, 4096, PROT_READ, MAP_SHARED, 21, 0) = 0x7f0938a28000
...
7749  open("/tmp/vtc.7648.2c3869d9/v1//_.vsm_child/_.VSC_cluster.09720dc34dd3559c", O_RDONLY) = 21
7749  mmap(NULL, 4096, PROT_READ, MAP_SHARED, 21, 0x1000) = 0x7f09389f9000
...
7749  open("/tmp/vtc.7648.2c3869d9/v1//_.vsm_child/_.VSC_cluster.09720dc34dd3559c", O_RDONLY) = 21
7749  mmap(NULL, 8192, PROT_READ, MAP_SHARED, 21, 0x1000) = 0x7f09389d2000
...
7749  open("/tmp/vtc.7648.2c3869d9/v1//_.vsm_child/_.VSC_cluster.09720dc34dd3559c", O_RDONLY) = 21
7749  mmap(NULL, 4096, PROT_READ, MAP_SHARED, 21, 0x2000) = 0x7f09389d1000

Notice that we keep the mappings at one or two pages now and do not increase
the length with the offset.

lib/libvarnishapi/vsm.c

@@ -720,7 +720,8 @@ VSM_Map(struct vsm *vd, struct vsm_fantom *vf)
 
 	sz = strtoul(vg->av[3], NULL, 10);
 	assert(sz > 0);
-	len = RUP2(of + sz, ps);
+	assert(of >= off);
+	len = RUP2(of - off + sz, ps);
 
 	vsb = VSB_new_auto();
 	AN(vsb);