#29 Avoid overflow in indirect update errors

[Mikhail Dmitrichenko]

exp_indirect_update1() reports validation failures for indirect -i
variables through a Tcl_VarTraceProc return string.

The error path formats the current interpreter result and the variable
name into a fixed 200-byte static buffer with sprintf(). A long result
or variable name can overflow that buffer before Tcl copies the trace
error.

Build the message with a static Tcl_DString instead. This keeps the
returned char pointer valid after the callback returns while allowing Tcl
to grow the backing storage as needed.

Found by Linux Verification Center (linuxtesting.org) with SVACE.