umath static analysis fixes

one significant memory leak (added in 1.9) and a few insignificant ones fixed, found by cpycheck

also fixed the api checksum warnings that occur due to the annotations not printed as repr (with pointer values) instead of str
do we actually have functions that take a tuple of `out` arguments?