CDRIVER-5878 Free child on failed call to bson_append_array_builder_begin

[kevinAlbs]

Summary

Free child on failed call to bson_append_array_builder_begin.

Verified with this patch build: https://spruce.mongodb.com/version/67a124ca58a59000075fa19d

Background & Motivation

Coverity identified a possible resource leak on this block. This roughly does the following:

if (BSON_APPEND_ARRAY_BUILDER_BEGIN (bson, "servers", &array)) {
    // ...
} else {
    return false; // Leaks `array`.
}

If bson_append_array_builder_begin returns false, the child out-param is left allocated. Whereas a failure in bson_append_array_begin does not require a clean-up of the child.

For consistency with bson_append_array_begin, this PR changes bson_append_array_builder_begin to free child on failure. child is set to NULL to permit existing code to safely call bson_append_builder_destroy.

[ghost]

Looks good to me! It's my fault for introducing an incorrect call site.

Looking at the documentation again, I can't find any warnings about the unusual choice to leave the output allocated on failure, so it does seem likely application code makes the same mistake. I agree this fix is likely to preserve backward compatibility. (Hopefully the vagueness of the documentation was enough warning that apps shouldn't rely on the child to be non-NULL on failure.)