wait_or_timeout: return failure when Curl_poll() fails

Coverity detected this. CID 1241954. When Curl_poll() returns a negative value
'mcode' was uninitialized. Pretty harmless since this is debug code only and
would at worst cause an error to _not_ be returned...
imap_perform_authentication: fix memory leak

Coverity CID 1215296. There's a potential risk for a memory leak in
here, and moving the free call to be unconditional seems like a cheap
price to remove the risk.
pop3_perform_authentication: fix memory leak

Coverity CID 1215287. There's a potential risk for a memory leak in
here, and moving the free call to be unconditional seems like a cheap
price to remove the risk.
multi_runsingle: fix memory leak

Coverity CID 1202837. There's a potential risk that 'newurl' gets
overwritten when it was already pointing to allocated memory.
detect_proxy: fix possible single-byte memory leak

Coverity CID 1202836. If the proxy environment variable returned an empty
string, it would be leaked. While an empty string is not really a proxy, other
logic in this function already allows a blank string to be returned so allow
that here to avoid the leak.
CURLOPT_HTTPHEADER.3: libcurl doesn't copy the whole list
ssh: improve key file search

For private keys, use the first match from: user-specified key file
(if provided), ~/.ssh/id_rsa, ~/.ssh/id_dsa, ./id_rsa, ./id_dsa

Note that the previous code only looked for id_dsa files. id_rsa is
now generally preferred, as it supports larger key sizes.

For public keys, use the user-specified key file, if provided.
Otherwise, try to extract the public key from the private key file.
This means that passing --pubkey is typically no longer required,
and makes the key-handling behavior more like OpenSSH.
ssh: comment "fallthrough" in switch statement
Curl_pipeline_server_blacklisted: handle a NULL server name

Coverity CID 1215284. The server name is extracted with
Curl_copy_header_value() and passed in to this function, and
copy_header_value can actually can fail and return NULL.
curl_multi_remove_handle: remove dead code

Coverify CID 1157776. Removed a superfluous if() that always evaluated
true (and an else clause that never ran), and then re-indented the
function accordingly.
Curl_debug: document switch fallthroughs
parse_proxy: remove dead code.

Coverity CID 982331.
nonblock: call with (void) to show we ignore the return code

Coverity pointed out several of these.
Curl_sec_read_msg: spell out that we ignore return code

Coverity CID 1241947. Since if sscanf() fails, the previously set value
remains set.
choose_mech: fix return code

Coverity CID 1241950. The pointer is never NULL but it might point to
NULL.
getparameter: comment a switch FALLTHROUGH

Coverity CID 1061118. Point out that it is on purpose.
getparameter: remove dead code

Coverity CID 1061126. 'parse' will always be non-NULL here.
curl_schannel.c: Fixed possible memory or handle leak

First try to fix possible memory leaks, in this case:
Only connssl->ctxt xor onnssl->cred being initialized.
ssh_statemach_act: split out assignment from check

just a minor code style thing to make the code clearer
tool_go_sleep: use (void) to spell out we ignore the return value

Coverity CID 1222080.