ftp/expectation: fix IPPair lock+refcount leak on alloc fail

AppLayerExpectationCreate gets a locked and ref counted
IPPair from IPPairGetIPPairFromHash. On the success path it correctly
drops both with IPPairUnlock (keeping the ref for lifecycle). The else-
branch that creates per-IPPair ExpectationLists calls SCCalloc. If
that allocation fails, neither Unlock nor Release is called, leaving
the IPPair mutex permanently held and its refcount elevated.

Any subsequent worker thread that looks up the same IPPair blocks
forever in SCCMutexLock.

This patch addresses this by properly releasing the IPPair in the
allocation error path.

Ticket: #8851.

src/app-layer-expectation.c

@@ -257,8 +257,10 @@ int AppLayerExpectationCreate(Flow *f, int direction, Port src, Port dst,
         }
     } else {
         exp_list = SCCalloc(1, sizeof(*exp_list));
-        if (exp_list == NULL)
+        if (exp_list == NULL) {
+            IPPairRelease(ipp);
             goto error;
+        }
         exp_list->length = 0;
         CIRCLEQ_INIT(&exp_list->list);
         CIRCLEQ_INSERT_HEAD(&exp_list->list, exp, entries);