firstboot: fix use-after-free/double-free of the Varlink reply in process_hostname()

ret_parameters (and ret_error_id) returned by sd_varlink_call()/
sd_varlink_callbo() are borrowed from the connection, as documented in
sd-varlink.h, and must not be unreffed by the caller. process_hostname()
declared its reply as _cleanup_(sd_json_variant_unrefp), freeing memory
owned by the Varlink connection and leading to a use-after-free/
double-free (the same bug class and ownership mistake just fixed for
pcrextend_pcr_now()/pcrextend_nvpcr_now() in 76a6dc6d).

(cherry picked from commit c556722826c4892939d2a6239ab00d0a343530a8)

src/firstboot/firstboot.c

@@ -794,7 +794,7 @@ static int process_hostname(int rfd, sd_varlink **mute_console_link) {
         }
 
         if (vl) {
-                _cleanup_(sd_json_variant_unrefp) sd_json_variant *reply = NULL;
+                sd_json_variant *reply = NULL;
                 const char *error_id = NULL;
                 r = sd_varlink_callbo(
                                 vl,