sspi: fix memory leaks on error paths in Curl_create_sspi_identity()

[vszakats]

Detected by Windows torture test 1072 (with -shallow=20/13),
test 579 (with -shallow=18/14/13), and test 1286 (with -shallow=15).

** MEMORY FAILURE
Leak detected: memory still allocated: 20 bytes
At 1a1e8136328, there is 18 bytes.
 allocated by D:/a/curl/curl/lib/curl_sspi.c:133
At 1a1e8139368, there is 2 bytes.
 allocated by D:/a/curl/curl/lib/curl_sspi.c:143
 1072: torture FAILED: function number 207 in test.
 invoke with "-t207" to repeat this single case.
Warning: http2 server unexpectedly alive

Ref: https://github.com/curl/curl/actions/runs/20008523913/job/57374427439?pr=19865

Also simplify the code a little.

Cherry-picked from #19865

[Copilot]

Pull request overview

This PR fixes memory leaks in the SSPI authentication code that were detected during Windows torture testing. The leaks occurred when error conditions were encountered after successful memory allocations, but before the function could complete.

Key Changes:

• Added missing curlx_free() calls for dup_user and dup_domain on all error paths after they are allocated
• Moved identity structure assignments to the end of the function, after all error paths, simplifying the code and ensuring proper cleanup on failures
• Ensures all allocated resources are properly freed before returning error codes

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.