Bug in String::copy, out of bounds crash

### Basic Infos

- [x] This issue complies with the [issue POLICY doc](https://github.com/esp8266/Arduino/blob/master/POLICY.md).
- [x] I have read the documentation at [readthedocs](https://arduino-esp8266.readthedocs.io/en/latest) and the issue is not addressed there.
- [x] I have tested that the issue is present in current master branch (aka latest git).
- [ ] I have searched the issue tracker for a similar issue.
- [ ] If there is a stack dump, I have decoded it.
- [ ] I have filled out all fields below.

### Problem Description

See line 291 (and line 280):

https://github.com/esp8266/Arduino/blob/eda4e0855fa5ebcf1d7f621f35f25f6bab503335/cores/esp8266/WString.cpp#L284-L293

When allocating an array of N elements, accessing element `[N]` is out of bounds.

This only happens sometimes at very specific string lengths, as `setLen` only allocates in multiples of N bytes.

N.B. similar issue for ESP32, so I will also add an issue there.

Suggested fix:
```c++
reserve(length + 1);
```

N.B. This function is likely to be called with `strlen()` or `strlen_P()` as argument, which does not include the ending null character.