src/daemon/utils_subst.c: Sanitize buffer offsets better.

src/daemon/utils_subst.c: Sanitize buffer offsets better.

The previous implementation broke when off1 / off2 were outside of "string"
but within "buflen". It also had problems if the replacement string was
too long. This new implementation truncates the buffer as expected and
is properly tested.