pcrextend: Fix use-after-free/double-free error in pcrextend_pcr_now

With SignInitrdPCRs=disabled in mkosi the TPM/PCR services are broken
which triggers the error path in the varlink call which means that we
get parameters set in the response. The wrong ownership assumption when
looking at the reply with _cleanup_ set caused a memory corruption that
surfaced in systemd-sysext with an ABRT.
This is a common mistake done with the API, fix it by not setting
_cleanup_(sd_json_variant_unrefp).

src/shared/pcrextend-util.c

@@ -58,7 +58,8 @@ int pcrextend_pcr_now(unsigned pcr, const char *word, const struct iovec *secret
         if (iovec_is_set(secret))
                 sd_json_variant_sensitive(parameters);
 
-        _cleanup_(sd_json_variant_unrefp) sd_json_variant *reply = NULL;
+        /* Both the reply and the error id are borrowed from the connection, don't unref/free them. */
+        sd_json_variant *reply = NULL;
         const char *error_id = NULL;
         r = sd_varlink_call(vl, "io.systemd.PCRExtend.Extend", parameters, &reply, &error_id);
         if (r < 0)
@@ -91,7 +92,8 @@ int pcrextend_nvpcr_now(const char *nvpcr, const char *word, const char *event)
         if (r < 0)
                 return r;
 
-        _cleanup_(sd_json_variant_unrefp) sd_json_variant *reply = NULL;
+        /* Both the reply and the error id are borrowed from the connection, don't unref/free them. */
+        sd_json_variant *reply = NULL;
         const char *error_id = NULL;
         r = sd_varlink_callbo(
                         vl,