bsdinstall: Replace correct, but fragile, string builder with open_memstream.

[jhb]

Summary

The old one triggered a false positive -Warray-bounds from GCC (the
compiler assumed len was always 0), but it was also fragile with
manually computed lengths paired with strcat vs using a string
builder.