Fix bug in decoding DHCP sub TLVs Fixes #536
Fix corner case in pairinsert/fr_cursor_insert

If we previously inserted a value pair, with no next pointer, and iterated to the end of the list, then inserted another vp with a next pointer, pairnext would return NULL, even though there were more value pairs available.