Fix double free() corruption due to config

[DL6ER]

Hey Simon,

the attached patch fixes a double free() corruption leading to a crash
during startup of dnsmasq. The crash can be reproduced by using a
rev-server addresses with a prefix length != {8,16,24,32}, e.g.

rev-server=192.168.0.0/25,home.mydomain.com

The crash is caused by freeing too early (within the loop). The crash
does not happen for prefix lengths {8,16,24,32} as the loop runs only
once. However, for other prefixes, the loop runs more often (e.g. 128x
for /25 networks as above).

Best,
Dominik

Tracked here: https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q2/017606.html