Overflow in FTP VMS date parser is real and ASan-reproducible

wget's FTP VMS listing parser copies a server-controlled token into a 32-byte stack buffer with strcpy() and strcat(). Although the code checks strlen(tok) < 12 before treating the token as a date, that check does not constrain the amount copied into date_str. A crafted long token containing '-' can still be classified as a date and overflow the stack buffer.