When sending the open confirmation in `packet_x11_open()` or
`packet_queue_listener()` returns EAGAIN, the resumed call loses the
channel it just allocated: the x11 path never saves it in
`x11open_state->channel`, so it links a NULL channel and crashes, and
the listener path clears `listen_state->channel` on every pass, so the
server gets a confirmation for a channel that is never queued and leaks.
This keeps the pointer in the state struct the same way
`packet_authagent_open()` already does, which I checked with a send
callback that returns EAGAIN once (ASan SEGV in `ssh2_list_add()`
before, and the channel reaches the x11 callback and the accept queue
after). I also looked at #1427, which touched the same EAGAIN return,
and this is the gap behind the question raised there about the channel
still being usable when the function is re-entered.
Reported-by: Yin Luming
Ref: https://github.com/LuMingYinDetect/libssh_defects/blob/main/libssh_1.pngFixes#1427Closes#2656
ff501d6346
