[CVE-2024-34459] Fix buffer overread with `xmllint --htmlout` Add a missing bounds check. Fixes #720.