Fixed two potential use-after-frees of the payload buffer

The first might occur if _libssh2_packet_add returns an error, as
fullpacket_state wasn't reset to idle so if it were possible for
fullpacket to be called again, it would return to the same state
handler and re-use the freed p->packet buffer.

The second could occur if decrypt returned an error, as it freed the
packet buffer but did not clear total_num, meaning that freed buffer
could be written into again later.
Fixed a few memory leaks in error paths
userauth: Fixed an attempt to free from stack on error
Fixed a few typos