XML: fix off-by-one in namespace prefix list parsing

XML: fix off-by-one in namespace prefix list parsing

njs_xml_parse_ns_list() allocated exactly size pointers, but the
terminating NULL was stored at the index equal to the number of parsed
tokens.  When the token count matched the current capacity, the
terminator was written one pointer past the allocation.

The growing loop is replaced with a single allocation holding the array
of pointers followed by the writable copy of the list, the number of
tokens is counted beforehand.

The list is split on any XML whitespace character, empty tokens are not
produced.

Also, fixed potential in place modification of QuickJS string value.

Reported by Vladimir Vulnerability Research Tech Lead @ Cyera, evilgensec