thttpd: update to 2.28.

From nia in PR 53266.

New in version 2.28:

    Improvements to the FreeBSD startup script. (Craig Leres)
    Minor portability tweak in mmc.c.
    Fix to buffer overrun bug in htpasswd. Reported by Alessio Santoru as CVE-2017-17663.

New in version 2.27:

    Stats syslogs changed from LOG_INFO to LOG_NOTICE.
    Use memmove() for self-overlapping string copies instead of strcpy().
    Couple of subroutine name changes for consistency.

(wiz)