pbx_variables.c: Misc fixes in variable substitution.

* Copy more than one character at a time when there is nothing to
substitute.

* Fix off by one error if a '}' or ']' is missing.

* Eliminated the requirement that the "used" parameter had to point to a
variable.  The current callers were always declaring a variable to meet
the requirement and discarding the value put into that variable.  Now it
can be NULL.

* In ast_str_substitute_variables_full() fixed using the bogus channel to
evaluate a function.  We were not using the bogus channel we just created
to help evaluate a subexpression.

Change-Id: Ia83d99f4f16abe47f329eb39b6ff2013ae7c9854