CVE-2026-8925: SASL double-free

We found a double-free in the GSASL authentication path — `Curl_auth_gsasl_is_supported()` frees `gsasl->ctx` on a failed `gsasl_client_start()` but never nulls the pointer, and then `Curl_auth_gsasl_cleanup()` frees it again unconditionally at connection teardown.

res = gsasl_client_start(gsasl->ctx, mech, &gsasl->client);
if(res != GSASL_OK) {
  gsasl_done(gsasl->ctx);   /* frees gsasl->ctx ... */
  return FALSE;              /* ... but gsasl->ctx still holds the freed pointer */
}