Fix a bug omitting the size of the PPS from STAP-A packets.

The size was being written into sps.length + 1 and 2, and then being overwritten by the SPS itself, because the SPS starts at stapa[3]. So the correct offsets should be 3 + 4.