Use kstring instead of strndup()

Avoid strndup(), which is a POSIX 2008 addition and is somewhat
problematic on e.g. Debian Lenny.

Use the recent htslib ks_release() addition for explicit ownership
transfers in this code and the recent new kstring-using code.