Fix substitute-command-keys unibyte, alloc bugs

Fix substitute-command-keys unibyte, alloc bugs

* src/doc.c (Fsubstitute_command_keys): Fix some problems with
unibyte strings and with buffer allocation.  Make strings
multibyte, to avoid problems with unibyte strings that are not
valid UTF-8 (Bug#24206).  Redo buffer allocation so that it is
O(N), not O(N**2).  Avoid going past the end of the input string
when given invalid input.  Avoid some unlikely problems in
accessing the wrong storage after a GC.