Fix an off-by-one error in vfscanf (both libstdio and ape versions) whereby
%n returns the wrong length if a string item (%s or %[) is terminated by
EOF (or end-of-string in the case of sscanf).

For a demonstration, see the test program below:
term% testscanf %s%n xxx
term% testscanf %[a]%n a

Before the fix:

sscanf("xxx", "%s%n", buf, &np) returns 1, np=4
sscanf("a", "%[a]%n", buf, &np) returns 1, np=2

After the fix:

sscanf("xxx", "%s%n", buf, &np) returns 1, np=3
sscanf("a", "%[a]%n", buf, &np) returns 1, np=1

===============================================
#include <u.h>
#include <libc.h>
#include <stdio.h>

void
main(int argc, char **argv)
{
	char buf[512];
	int np, n;

	if(argc != 3)
		sysfatal("Usage: testscanf pattern string");
	np = 0;
	n = sscanf(argv[2], argv[1], buf, &np);
	print("sscanf(\"%s\", \"%s\", buf, &np) returns %d, np=%d\n", argv[2], argv[1], n, np);
	exits(0);
}