Fix various memory leaks discovered through valgrind

This fixes what #3207 started.  Turns out there were two problems with #3207: the data array ended up with 2 refcount at the end of the function.  Then, when it is later passed to `_image.Image.frombuffer`, that method *also* leaked a reference.  *sigh*.

Also, fixes a leak in the collection transform array, and another in the "generic" font I/O that is used to load fonts from a BytesIO buffer (very rarely used, but the test suite does exercise it).