Clean up gpst parse_portal_xml() a little

Clean up gpst parse_portal_xml() a little

There was a potential crash if building up the XML in 'buf' didn't
work, because buf->data could be NULL yet we still passed it back
to vpninfo->write_new_config(). So check with buf_error() first.

We can't use a 'static' form because in theory this can be invoked
twice simultaneously for different VPNs, in the same process (and it
isn't even *impossible* the way kde-plasma-nm handled authentication).

Add a FIXME for the fact that we aren't escaping characters which need
it in the XML we build up.

Some other cosmetics, like using calloc() as $DEITY intended instead
of duing the multiplication ourselves.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>