A student pepper-sprayed a lone gunman who had already killed one man at a US university while he paused to reload, helping to prevent more deaths, police have said.