Fix heap corruption that could occur when HSTS feature is enabled

At least on Windows, when realloc() is used to allocate a new buffer,
guess what's in that buffer initially? undefined values. So you can't
strcat() onto the end of that! Ouch. This was a fun one to track down.

src/sbbs3/websrvr.c

@@ -2779,6 +2779,8 @@ static BOOL parse_headers(http_session_t * session)
 								else {
 									if (session->req.vary_list)
 										strcat(p, ", ");
+									else
+										*p = '\0';
 									strcat(p, get_header(HEAD_UPGRADEINSECURE));
 									session->req.vary_list = p;