Setting up auth: grant-permission of prefixed paths behaves unexpected, turning last character of prefix into another.

Dear community.

> Context: I am trying to set up etcd (username:password) authentication for seaweedfs filer service.

Please let me know whether this is expected behaviour or a user-error.

## version & environment variables

Using:

```bash
$ etcd --version
etcd Version: 3.4.23
Git SHA: Not provided (use ./build instead of go build)
Go Version: go1.21.0
Go OS/Arch: linux/amd64

$ etcdctl version
etcdctl version: 3.4.23
API version: 3.4

$ env | grep -i etcd
ETCDCTL_ENDPOINTS=http://10.0.0.1:2379
ETCDCTL_API=3
```

## topic: setting up allowed paths for authenticated etcd user `weed`

These are the assumed steps from a vanilla etcd setup on a Ubuntu 23.10 server where I am trying to give all relevant permissions which seaweedfs filer needs:

Starting point: No users, no roles yet.
```bash
$ etcdctl user list
$ etcdctl role list
```

Adding users (root, weed), roles (root, weed) and granting them and finally enable auth.

```bash
$ etcdctl role add root
Role root created
$ etcdctl user add root
Password of root:
Type password of root again for confirmation:
User root created
$ etcdctl user grant-role root root
Role root is granted to user root
$ etcdctl user add weed
Password of weed:
Type password of weed again for confirmation:
User weed created
$ etcdctl role add weed
Role weed created
$ etcdctl role grant-permission weed --prefix=true readwrite weed.
Role weed updated
$ etcdctl role get weed
Role weed
KV Read:
[weed., weed/) (prefix weed.)
KV Write:
[weed., weed/) (prefix weed.)
$ etcdctl user grant-role weed weed
$ etcdctl auth enable
Authentication Enabled
```

Since this seems not to cover all paths I started adding more by reading in the log of filer which paths should be readwritable and adding them:

```
$ etcdctl --user=root role grant-permission weed --prefix=true readwrite /topics
Password:
Role weed updated
$ etcdctl --user=root role grant-permission weed --prefix=true readwrite /buckets
Password:
Role weed updated
$ etcdctl --user=root role grant-permission weed --prefix=true readwrite /etc/remote
Password:
Role weed updated
$ etcdctl --user=root role get weed
Password:
Role weed
KV Read:
[/buckets, /buckett) (prefix /buckets)
[/etc/remote, /etc/remotf) (prefix /etc/remote)
[/topics, /topict) (prefix /topics)
[weed., weed/) (prefix weed.)
KV Write:
[/buckets, /buckett) (prefix /buckets)
[/etc/remote, /etc/remotf) (prefix /etc/remote)
[/topics, /topict) (prefix /topics)
[weed., weed/) (prefix weed.)
```

## Bug Description

> Now to the bug (unexpected behaviour when adding prefix):

Interestingly when adding `/buckets`, there is a second path called `/buckett`.
The same for
- /etc/remote -> /etc/remotf
- /topics -> /topict

When trying to remove those erroneous paths it is not recognized.

```bash
$ etcdctl --user=root role revoke-permission weed readwrite /etc/remotf
Password:
{"level":"warn","ts":"2023-12-11T11:54:01.848+0100","caller":"clientv3/retry_interceptor.go:62","msg":"retrying of unary invoker failed","target":"endpoint://client-43c09c7e-58b2-4d98-9246-abcdefg/10.0.0.1:2379","attempt":0,"error":"rpc error: code = FailedPrecondition desc = etcdserver: permission is not granted to the role"}
Error: etcdserver: permission is not granted to the role
```

Am I doing something terribly wrong (specifying prefixed path wrongly) or is it a bug (turning s into t, e into f - looks like char +1 / off-by-one error)?