fix: add length check to xmlURIEscapeStr in uri.c

Commit 538b2e38 fixed xmlBuildRelativeURISafe for the pattern where
xmlStrlen() returns 0 for strings longer than INT_MAX, but
xmlURIEscapeStr was not fixed. Without the check, len = 0 + 20, and
the write loop eventually overflows via int wrapping of the out counter.

Add a return NULL guard when xmlStrlen returns 0.

uri.c

@@ -1644,6 +1644,8 @@ xmlURIEscapeStr(const xmlChar *str, const xmlChar *list) {
     if (str[0] == 0)
 	return(xmlStrdup(str));
     len = xmlStrlen(str);
+    if (len == 0)
+        return(NULL);
 
     len += 20;
     ret = xmlMalloc(len);