Fix leak when cURL PREREQFUNCTION returns a type other than int (#22726)

The return value of the function registered with CURLOPT_PREREQFUNCTION was
not cleaned up when it returned an invalid non-int type. Destroy the callback
return value before throwing a TypeError.

The test now returns a dynamically allocated array containing random_bytes(),
so leak detection exercises the zval cleanup path reliably.

Closes #22726

Author: Sjord

ext/curl/interface.c

@@ -770,6 +770,7 @@ static int curl_prereqfunction(void *clientp, char *conn_primary_ip, char *conn_
 				zend_value_error("The CURLOPT_PREREQFUNCTION callback must return either CURL_PREREQFUNC_OK or CURL_PREREQFUNC_ABORT");
 			}
 		} else {
+			zval_ptr_dtor(&retval);
 			zend_type_error("The CURLOPT_PREREQFUNCTION callback must return either CURL_PREREQFUNC_OK or CURL_PREREQFUNC_ABORT");
 		}
 	}

ext/curl/tests/curl_setopt_CURLOPT_PREREQFUNCTION.phpt

@@ -77,7 +77,7 @@ try {
 
 echo "\nTesting with invalid type\n";
 curl_setopt($ch, CURLOPT_PREREQFUNCTION, function() use ($port) {
-	return 'this should be an integer';
+	return ['this should be an integer' => random_bytes(64)];
 });
 try {
     curl_exec($ch);