Fix issue #125: Don't escape HTML tags in tables of contents.

Before this patch, a header like "# *A*" was displayed as
"<li>&lt;em&gtA&lt;/em&gt;</li>" in the TOC. The error was caused by
toc_header doing the HTML escaping. In the normal HTML renderer, the escaping
is done by the normal_text hook. This patch uses the same handling to
fix the issue.
Fix out-of-bounds memory access in tab expansion.

The loop performs two jobs: Find the first tabstop, and counting the number of
characters before it. To count the number of characters before the
tabstop, it counts all bytes that are not UTF-8 continuation bytes.
The current form of the loop doesn't check the first character, but
checks the character past the range's end. Since these are both
usually non-continuation characters, it does the right thing accidentally.
However, it accesses the character range at index `size`, which is
forbidden and might be uninitialized for strings that are not
null-terminated.