combine_path: Survive string_builder without NUL-terminations.

The string_builder API no longer maintains NUL-termination of the
buffer. This caused combine_path_nt() et al to fail intermittently
due to reading past the buffer end.

Also adds a corresponding test.

Fixes [bug 7723].