Fix buffer overrun on multi-char SVG hkern u1="..."

svg.c routine scans the argument variable utf8 (from hkern u1="..." or
u2="..." attribute values) for contained characters, finding the glyph
name for each and accumulating the total string length needed to copy
all of these glyph names into one string.  Only it doesn't, having
missed the '+' in
                len += strlen(temp->name)+1;

This fix corrects the typo, correctly accumulating the needed string
length for use with the following malloc().

Without the fix an hkern element like:
    <hkern u1="&#xE124;,&#xE125;,&#xE126;,&#xE127;,&#xE128;,&#xE129;,&#xE12A
           u2="&#xE110;"  k="375"   />
will cause errors such as:
      Segmentation fault (core dumped)
As few as three or four characters in one u1="..." will crash FontForge.