curl: 54: Rejected HTTP/2 push destroys MIME callback state still used by parent (use-after-free)

Summary pushpromise in lib/http2.c duplicates the parent easy handle before validating the pushed URL. When validation fails e.g. unsupported scheme, discardnewhandle destroys the duplicate. For callback-backed MIME uploads, Curlmimeduppart copies the same readfunc, freefunc, and arg pointer, so...