curl: libcurl shared-HSTS-cache race leads to use-after-free with attacker-controlled function-pointer call

Missing lock on the shared HSTS cache in lib/hsts.c CURLLOCKDATAHSTS allows a race that frees an stsentry still referenced by another thread — deterministic same-address reclaim proves the freed object is fully attacker-writable and its destructor pointer is called with an attacker-chosen argumen...