Fix ESI Parsing when VEP_Parse is called on tag which shares a prefix with another

Example for the case addressed here is an html comment which is not esi.

	1st call on !--e
	2nd call on !--end

The first call could match !--esi:, so vep_match() does not return with
VEP_NOTMYTAG, but with null, so characters up until 'e' are marked.

For the second call, we need to consider the case that characters after
the end of the tag could already be marked.

Fixes #1988

bin/varnishd/cache/cache_esi_parse.c

@@ -946,8 +946,11 @@ VEP_Parse(struct vep_state *vep, const char *p, size_t l)
 			} else {
 				vep->match_hit = vm;
 				vep->state = *vm->state;
-				if (vm->match != NULL)
-					p += strlen(vm->match) - vep->tag_i;
+				if (vm->match != NULL) {
+					i = strlen(vm->match);
+					if (i > vep->tag_i)
+						p += i - vep->tag_i;
+				}
 				vep->match = NULL;
 				vep->tag_i = 0;
 			}

bin/varnishtest/tests/e00019.vtc

@@ -21,6 +21,10 @@ server s1 {
 	chunkedlen 65536
 	chunked {<esi:comment/>}
 
+	chunked {<!--e}
+	delay .4
+	chunked {nd:comment>}
+
 	chunkedlen 0
 } -start
 
@@ -55,8 +59,8 @@ client c1 {
 	txreq  -url bar
 	rxresp
 	expect resp.status == 200
-	expect resp.bodylen == 65840
+	expect resp.bodylen == 65856
 } -run
 
-varnish v1 -expect esi_errors == 4
+varnish v1 -expect esi_errors == 5
 varnish v1 -expect esi_warnings == 1