Use-after-free in `curl_easy_duphandle()` with HTTP/2 stream-dependency tree

We've found an issue in `lib/easy.c` where `curl_easy_duphandle()` shallow-copies `set.priority`, so the original and the duplicate end up holding two independent pointer-typed variables that both reference the same heap-allocated `Curl_data_prio_node` chain. Freeing the chain from one side leaves …

dst->set = src->set;