Out-of-bounds read in curl_formadd when CURLFORM_NAMELENGTH is explicitly 0

I've discovered a heap out-of-bounds read in `curl_formadd` that causes libcurl to silently read past a caller-supplied buffer and transmit the leaked contents to the remote server. It's confirmed under ASan and reachable without violating any documented precondition.

static CURLcode forminfo_copyfield(struct bufref *field, size_t len)
{
  const char *value = Curl_bufref_ptr(field);
  CURLcode result = CURLE_OK;

  if(value) {
    if(!len)
      len = strlen(value);           /* line 128 */
    result = Curl_bufref_memdup0(field, value, len);
  }

  return …