Fix swap status control

This fixes two issues related to swap status control:

1. During a swap, the status was written offset by one, because it was
   being incremented before it was written to flash. With the increment
   happening early the offset was calculated always one position after
   where it should be, which would leave the first status index free,
   and override the last one (worst case scenario).
2. When an image is too big it requires the swap status to be
   temporarily stored on scratch, to allow the last sector on the
   primary slot to be erased. The status is written to scratch for 2
   status updates, and afterwards copied back to the primary slot, which
   then receives future status updates. The code that copied the status
   back from scratch to the primary slot was erroneously copying the space
   of 3 status writes, which would result in a write over non-erased area
   for the third byte.

Signed-off-by: Fabio Utzig <utzig@apache.org>