ext/com_dotnet: release the held IUnknown in com_get_active_object()

The cleanup block guarded on `unk` but released `obj`. On a successful
GetActiveObject() this released the IDispatch proxy twice and leaked the
IUnknown; on a QueryInterface failure `obj` is still NULL while `unk` is
live, so the same line released NULL through a NULL vtable and crashed
instead of throwing. Release `unk` so each interface pointer is released
exactly once and the failure path no longer crashes.

Closes GH-22378

Author: iliaal

ext/com_dotnet/com_com.c

@@ -321,7 +321,7 @@ PHP_FUNCTION(com_get_active_object)
 		IDispatch_Release(obj);
 	}
 	if (unk) {
-		IUnknown_Release(obj);
+		IUnknown_Release(unk);
 	}
 	efree(module);
 }