msi: ExpandEnvironmentStringsW returns the required size in characters, so multiply the required size by sizeof(WCHAR) when allocating the buffer.

index is 1-based, so take that into account when calculating the
pointer to pass into the compare function.

Using the _bstr_ allocator adds the returned string to a cache, so the
string shouldn't be freed with SysFreeString. Therefore, just replace
the lone call to _bstr_ in this function by a straight call to
SysAllocString.

Found by Valgrind.