The string in format is nul-terminated so use memcpy to copy it into
the buffer and don't try to nul-terminate it manually which causes a
write outside of the allocated buffer length.

Fix a similar off-by-one error in CLIPFORMAT_UserUnmarshal too. This
time it is only reading from beyond the buffer.

According to the documentation, only audio device vendors are allowed to 
call this function, so make sure we properly restore the old speaker config.

mshtml: Check for CATID_SafeForScripting in GUID_CUSTOM_CONFIRMOBJECTSAFETY implementation if IObjectSafety is not available.