[sanitizer] Fix handling of %n in scanf interceptor.

%n does not increase the input item count. The new code emits writes to %n
arguments even if it has run out of input items.