urlapi: off-by-one in custom scheme validation skips last character

In `lib/urlapi.c`, the `set_url_scheme()` function has an off-by-one error when validating custom scheme names. The validation loop checks `scheme[0]` twice (once by `ISALPHA`, once in the loop) and never checks the last character. This allows schemes ending with any arbitrary byte (e.g., `foo!`, …

#include <stdio.h>
#include <curl/curl.h>

int main(void) {
  CURLU *url;
  CURLUcode rc;
  const char *schemes[] = {"bad!", "bad{", "bad/", "bad\\", "a!", NULL};

  for(int i = 0; schemes[i]; i++) {
    url = curl_url();
    rc = curl_url_set(url, CURLUPART_SCHEME, schemes[i], …