[BUG] Keep an aborted session alive until its handle is freed

Handing the easy handle over untouched leaves CURLOPT_PRIVATE and the write,
header, read and progress callback data pointing at the session and its
operation. Clearing them was what made that safe before, and this branch
stopped clearing them on purpose, because the cancelling thread does not own
a handle the multi handle may still be driving.

The owner then has to outlive the handle, and on the abort path it did not.
ScheduleAbortSession takes the session out of sessions_, so doRemoveSessions
cannot find it to hold one, and doAbortSessions kept the only remaining
shared_ptr in a local map that died on return. The handle could reach
curl_multi_remove_handle and curl_easy_cleanup with those pointers dangling,
and curl_easy_cleanup is documented as able to run the progress and header
callbacks.

pending_to_remove_sessions_ already exists for this: doRemoveSessions swaps it
out and holds it until the handle is freed. The abort path hands the session
to it now.

26 tests pass, 3 of 3, and under AddressSanitizer with leak detection 2 of 2
with no leaks and no errors.

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

Author: thc1006

ext/src/http/client/curl/http_client_curl.cc

@@ -765,7 +765,7 @@ bool HttpClient::doAbortSessions()
   }
 
   bool has_data = false;
-  for (const auto &session : pending_to_abort_sessions)
+  for (auto &session : pending_to_abort_sessions)
   {
     if (!session.second)
     {
@@ -777,6 +777,15 @@ bool HttpClient::doAbortSessions()
       session.second->FinishOperation();
       has_data = true;
     }
+
+    // FinishOperation queued the easy handle for removal, and that handle still holds
+    // CURLOPT_PRIVATE and the callback data pointing into this session and its operation.
+    // doRemoveSessions cannot find the session to hold, because aborting took it out of
+    // sessions_, so hand it the owner directly: it keeps one until the handle is freed.
+    {
+      std::lock_guard<std::recursive_mutex> session_id_lock_guard{session_ids_m_};
+      pending_to_remove_sessions_.emplace_back(std::move(session.second));
+    }
   }
   return has_data;
 }