Heap-use-after-free in CURLOPT_REFERER when passed a CURLINFO_REFERER pointer

Setting `CURLOPT_REFERER` with a pointer previously obtained from `CURLINFO_REFERER` on the same easy handle triggers a heap-use-after-free. The `CURLOPT_REFERER` handler frees `data->state.referer` (line `lib/setopt.c:2089`) before `Curl_setstropt` reads from the now-dangling pointer (line …

// lib/setopt.c:2085-2091
case CURLOPT_REFERER:
    Curl_bufref_free(&data->state.referer);          // frees the buffer
    result = Curl_setstropt(data, STRING_SET_REFERER, ptr); // reads from ptr
    break;