major bugfix; IAC+IAC escaping

untested until test cases are written, but I'm very sure that this is not working as expected. If IAC+IAC is sent, self.telnet_got_sb is *NOT* True on the 2nd byte ! So the escaping never occurs
continuation of IAC+IAC bugfix

the 2nd IAC was incorrectly placed into the subnegotiation buffer.