ext/curl: Free the pushed handle when the push callback denies or throws

[iliaal]

When the callback denies the push, or throws and leaves the return value undefined, libcurl destroys the easy handle itself, but the wrapper kept a stale ch->cp after a throw and never released the CurlHandle it had just created, so each denied push leaked one wrapper and permanently bumped the parent's clone counter. The callback now clears ch->cp and drops its reference, and curl_free_obj() keys its constructor-failure exit on ch->clone, so the handlers are released whenever the last reference goes, including when the callback keeps the handle. The new tests need Caddy, so they only run in the lanes that have it.

[Sjord]

Nice. Does this work correctly if the CURLMOPT_PUSHFUNCTION callback stores one of the handles? The callback adds a reference to the curl handle, but its handlers are still freed, and may be referenced later.

[iliaal]

Ah, it didn't: the kept handle's handlers were freed while it stayed reachable, so a later GC run could read freed memory. The callback now only clears the easy handle and drops its own reference, and curl_free_obj() releases the handlers when the last reference goes. Added a test that keeps the handle. Since its easy handle is gone, curl_reset(), curl_copy_handle() and clone already crash on a kept handle before this PR; I'll send that separately.