Fix: xml: Correctly subtract xml with v1 patchsets

The recursive invocaion of __subtract_xml_object(target_child, patch_child)
could free target_child. So __xml_next(target_child) at the end of the
loop might not get the next child.
Fix: cib: Resolve memory leaks in query paths
Fix: xml: Prevent use-after-free when comparing two xml documents