BUG/MINOR: cfgcond: revisit the condition freeing mechanism to avoid a leak

BUG/MINOR: cfgcond: revisit the condition freeing mechanism to avoid a leak

The cfg_free_cond_{term,and,expr}() functions used to take a pointer to
the pointer to be freed in order to replace it with a NULL once done.
But this doesn't cope well with freeing lists as it would require
recursion which the current code tried to avoid.

Let's just change the API to free the area and let the caller set the NULL.

This leak was reported by oss-fuzz (issue 36265).