rtld: Sync 4/7 - Fix token substitution

rtld: Sync 4/7 - Fix token substitution

The origin_subst_one() function limits the length of the string to
PATH_MAX after the token substitution.  This is wrong, because
origin_subst_one() performs the substitution on the whole rpath and
similar strings, which contain several pathes separated by colon.  As
result, a long (but correct) rpath consisting of many path elements is
rejected by the function.

Correct the problem by rewriting the origin_subst_one() to perform two
passes, first pass to calculate the number of substitutions to be
performed, and second pass to generate the resulting string.  Second
pass allocates the memory for the result based on the count from the
first pass, without enforcing a limit.

Taken verbatim from:
FreeBSD SVN 249525 (15 APR 2013)
FreeBSD SVN 250075 (29 APR 2013)