Avoid an MSVC debug assertion and C++03 u.b. (johnny0)

We were using operator[] to access one-past-the-end of a std::string,
expecting a null terminator.  However, in C++03, this is only allowed
with the const version of operator[], producing undefined behaviour
with the non-const version.  In particular, MSVC with _SECURE_SCL
(default for debug builds) would throw a runtime exception.

Adjust the bounds of the loop so we don't iterate up to the last
character.  This doesn't change the behaviour in non-crashing cases,
because the one-past-the-end '\0' is not a VAR_CHAR and would break
the loop anyway.

We could use a const_cast<const string &> or a constify template
instead, but this version is less code.

(cherry picked from commit 1ba5a8cb38dc2a3f8f4e1fcfd1c981d961633ff7)