portfwdmgr_config: null out pointers we're destroying.

In particular, a report today pointed out that the call to
pfl_terminate(pfr->local) directly from portfwdmgr_config() was then
repeated from inside pfr_free(pfr) which we called four lines later,
leading to a double-free crash. Now we null out pfr->local the first
time, so the call in pfr_free is skipped.

While I'm at it, I've nulled out pfr->remote similarly; that doesn't
cause any crash that I can see, but it's a good habit to get into for
futureproofing.

portfwd.c

@@ -959,8 +959,10 @@ void portfwdmgr_config(PortFwdManager *mgr, Conf *conf)
                  * rejected.
                  */
                 ssh_rportfwd_remove(mgr->cl, pfr->remote);
+                pfr->remote = NULL;
             } else if (pfr->local) {
                 pfl_terminate(pfr->local);
+                pfr->local = NULL;
             }
 
             delpos234(mgr->forwardings, i);