improve memory safety of allocs in stmt.query

Two commits. First is minor preparatory refactoring. Second is a fix for some memory management snafus in the multi-statement section of stmt.query: a double free and some leaks. See individual commit messages for details.

All issues have reliable reproducers; feel free to keep only the tests and fix in any other way you see fit. :)

I considered whether a private security report was appropriate here, given that this touches on memory management, but I believe that exploitation requires being able to run specific sets of queries at high volume, at which point, you likely have much bigger problems. If you gauge that this was a mistake and would like me to have a lower threshold for privately reporting theoretical security concerns, just say the word and I'll adapt.