CVE-2026-92388: FTP wildcard write callback mixup

A failed FTP wildcard `LIST` leaves `data->set.fwrite_func` pointing at libcurl's internal listing parser and `data->set.out` pointing at the easy handle itself, because the code path that restores them is only reached on a *successful* listing. That alone is a crash on reuse. However, …

// lib/ftp.c:4019-4026
/* backup old write_function */
ftpwc->backup.write_function = data->set.fwrite_func;
data->set.fwrite_func = Curl_ftp_parselist;
/* backup old file descriptor */
ftpwc->backup.file_descriptor = data->set.out;
data->set.out = data;