TagString: use strndup() for unterminated string

Fixes buffer overflow bug.
TagString: return WritableBuffer<char>