creds-util: automatically append NUL byte to decrypted creds

Both as safety net and as convenience feature of a string is contained
in the credential

src/shared/creds-util.c

@@ -1376,7 +1376,7 @@ int decrypt_credential_and_warn(
         if (ret) {
                 char *without_metadata;
 
-                without_metadata = memdup((uint8_t*) plaintext + hs, plaintext_size - hs);
+                without_metadata = memdup_suffix0((uint8_t*) plaintext + hs, plaintext_size - hs);
                 if (!without_metadata)
                         return log_oom();