CURLOPT_HSTS_CTRL disables shared HSTS without share guard — use-after-free and double-free

`CURLOPT_HSTS_CTRL` set to a value without `CURLHSTS_ENABLE` unconditionally frees the easy's HSTS object — even when that object is shared via a `CURLSH`. The result is a use-after-free and a double-free on the shared 48-byte `struct hsts` block when the share or any other linked easy is later …

case CURLOPT_HSTS_CTRL:
  if(arg & CURLHSTS_ENABLE) {
    if(!data->hsts) {
      data->hsts = Curl_hsts_init();
      ...
    }
  }
  else
    Curl_hsts_cleanup(&data->hsts);   /* <-- no share guard */
  break;