hx509_request_get_san can return an output string on failure

Tighten up all of the call sites of hx509_request_get_san()
to free the output string returned upon failure.

Use frees(&s) instead of free(s); s = NULL;.

Change-Id: I71035d7c1d2330a1a3a1b3b730cdd6ba1e6b7da3

lib/hx509/ca.c

@@ -2353,7 +2353,6 @@ count_sans(hx509_request req, size_t *n)
     for (i = 0; ret == 0; i++) {
         hx509_san_type san_type;
 
-        frees(&s);
         ret = hx509_request_get_san(req, i, &san_type, &s);
         if (ret)
             break;
@@ -2370,6 +2369,7 @@ count_sans(hx509_request req, size_t *n)
         }
         frees(&s);
     }
+    free(s);
     return ret == HX509_NO_ITEM ? 0 : ret;
 }