Fix buffer-smashing bug in ReaderScanner.loadAndRetain()

The loop always inserted characters at the same position, so if more
than one call to the underlying Reader's read() method were needed
to get the desired number of characters, each call would overwrite
the characters from the previous one.  See
    https://gist.github.com/stebulus/63051af547bc5060910f
for a concrete example.
Fix buffer-smashing bug in StreamScanner.loadAndRetain()

This is the same bug as the one in ReaderScanner fixed by commit
0271ae8fa7e685e4371b6378567871854ea3cc6f
Merge branch 'fix-buffer-smash'

* fix-buffer-smash:
  Fix buffer-smashing bug in StreamScanner.loadAndRetain()
  Fix buffer-smashing bug in ReaderScanner.loadAndRetain()