ntpd: bound remote config error accumulation

[carrerasdarren-cell]

Summary

Bound remote parser error accumulation with the existing xsbprintf() helper.
The previous code advanced remote_config.err_pos by snprintf()'s
would-have-written length, so a truncated diagnostic could move the cursor past
the 1024-byte err_msg array.

Security impact

A client with a valid mode 6 control key can submit many remote-only parser
diagnostics in one authenticated :config request. In a local sanitizer build,
enable followed by 70 mode7 tokens advanced the cursor to index 1063,
overwrote adjacent daemon state, and ended in an AddressSanitizer crash.

The patch appends only complete messages that fit and derives err_pos from the
bounded helper cursor. The error count is still accurate even when the response
buffer is full.

This is a transparent, modernized port of
NTPsec commit a619d39ac2b6d3b435edd2f6f527c7cc81f78d02,
authored by Gary E. Miller in 2018. I am not claiming the root cause as a new
discovery.

Verification

• Normal Clang build of ntpd passes.
• Existing test-sbprintf suite passes: 8 tests, 0 failures.
• Vulnerable authenticated loopback replay reproduces the out-of-bounds write
  and daemon crash under ASan/UBSan.
• Patched replay records all 70 errors, returns only complete messages that fit,
  remains alive, and handles a second authenticated command successfully.