Fix tmpl_from_attr_substr()

So that it stops at the first non-attribute character,
instead of erroring out.

Issues found by the new expression parser
Fix rlm_expr to use correct operator precedence.

Along with attribute references.  And !1 and -1.
And attribute references.  And documentation.