userauth: free list packet on oversize methods in userauth_list() error path

userauth_list() keeps the server's USERAUTH_FAILURE/BANNER response in
session->userauth_list_data. Five of its error returns free that buffer
before returning NULL (the data_len < 5 check, the three banner checks,
and the SUCCESS case), but the oversize-methods check does not. When a
server sends a methods length field that is >= the bytes actually
present, the function returns at the LIBSSH2_ERROR_OUT_OF_BOUNDARY
branch with the response packet still allocated, so it leaks (the
pointer is only reclaimed at session teardown, or overwritten and leaked
again if the caller retries).

The patch adds the SSH2_SAFEFREE already used by the adjacent data_len <
5 branch, so the last error path frees what the function owns. Trigger
is a server response whose methods length field exceeds the packet body.

Closes #2667

src/userauth.c

@@ -214,6 +214,7 @@ static char *userauth_list(LIBSSH2_SESSION *session, const char *username,
 
         methods_len = ssh2_ntohu32(session->userauth_list_data + 1);
         if(methods_len >= session->userauth_list_data_len - 5) {
+            SSH2_SAFEFREE(session, session->userauth_list_data);
             ssh2_err(session, LIBSSH2_ERROR_OUT_OF_BOUNDARY,
                      "Unexpected userauth list size");
             return NULL;