fix separator buffer overflow in MRns_name_uncompress_list

[zayeem06]

MRns_name_uncompress_list writes a comma separator and a trailing NUL between decoded names but only checks that one byte of the output buffer is still free, so when one name fills the buffer exactly and another name follows it writes the NUL one byte past the end. The path is reachable through concat_dclists when a client-supplied dhcp6.domain-search list is decoded into the fixed uncompbuf. The fix returns EMSGSIZE when fewer than two bytes remain for the separator; the added test in ns_name_test.c clobbers a sentinel byte just past the buffer on the unpatched code and is clean after, and the existing multi-name decode still round-trips.

[zayeem06]

any update?