curl: Use-after-free of the internal multi->admin easy handle via the documented CURLMOPT_NOTIFYFUNCTION callback

Summary: curlmultiinit creates an internal easy handle multi-admin and marks it state.internal = TRUE lib/multi.c:248. The CURLMOPTNOTIFYFUNCTION callback is handed that internal handle on CURLMNOTIFYINFOREAD lib/multintfy.c:109, and the option documentation invites callbacks to remove and clean ...