tree: Fix integer overflow in xmlBuildQName This issue affects memory safety and might receive a CVE ID later. Fixes #926.