In case of an encoding error in string::merge, the appended string value
is left with broken UTF-8 in case of an error. The same can happen if
any of the Buf methods panics. This results in UB if the string value is used
after the error return or in unwind, respectively.

Change the implementation to truncate the string back to valid UTF-8
content in any code path that does not go through validation of the
newly appended bytes.

Test that adding an invalid UTF-8 sequence results in an error,
and that the string is reverted to its state prior to the merge call.

As suggested by Dan Burkert:
https://github.com/danburkert/prost/pull/194#discussion_r292096009

The existing string value is dropped in case of a merge failure,
but this is better than exposing an invalid value.