patch 9.2.0770: dict_add_dict() has inconsistent ownership on failure

patch 9.2.0770: dict_add_dict() has inconsistent ownership on failure

Problem:  dict_add_dict() frees the passed dict on one failure path
          (when dict_add() fails) but not on the other (when
          dictitem_alloc() fails), so a caller cannot tell whether it
          still owns the dict after a failure.  Callers that unref the
          dict on failure (e.g. in window.c) then double-free it when
          dict_add() fails.
Solution: Make the failure contract consistent: on failure leave the
          passed dict untouched and owned by the caller; only take a
          reference on success.

related: #20668

Supported by AI.

Signed-off-by: Christian Brabandt <cb@256bit.org>