WebSocket send queue use-after-free during nested curl_ws_send()

At `lib/ws.c:1734`, `ws_flush()` borrows a pointer from the outgoing `sendbuf` and passes it to `ws_send_raw_blocking()`; it skips those bytes only after the send returns. A `curl_ws_send()` from the WebSocket write callback can be interrupted by a TCP-trace debug callback that calls …

   POC=/absolute/path/to/h1-attachments
   git checkout curl-8_23_0
   cmake -S . -B bld-asan -DBUILD_SHARED_LIBS=OFF -DBUILD_STATIC_LIBS=ON -DENABLE_DEBUG=OFF -DCURL_DISABLE_VERBOSE_STRINGS=OFF -DCMAKE_C_FLAGS="-fsanitize=address -fno-omit-frame-pointer -g"
   cmake --build bld-asan --target …