NEWS: add an entry about the use of `strndup()`
compat: fix strndup