Mosaic: fix one-byte-too-short buffer in solve_game().

Thanks to Jason Hood for the report. The crash is trivially reproduced
under Address Sanitizer if you set up the game id 15x15#12345 and then
use the Solve UI action.

mosaic.c

@@ -951,7 +951,7 @@ static char *solve_game(const game_state *state,
         return NULL;
     }
 
-    ret = snewn((size / 4) + 3, char);
+    ret = snewn((size / 4) + 4, char);
 
     ret[0] = 's';
     i = 0;