PHP-1161: Remove dependecies on Cyrus-SASL from SCRAM-SHA-1

No, we don't need the original in the second call, since we want to operate on the modified/escaped version on the username to pass it through escape again.
Now that you mention a memleak though, its likely the the return variable and the first argument can't be the same as it does need to be free()d...