glibc fixes wordexp use-after-free on WRDE_APPEND errors

The GNU C Library has fixed a use-after-free in wordexp when callers append words with the WRDE_APPEND flag and the expansion fails for a reason other than running out of memory.

CVE-2026-6368 (also tracked as BZ 34090) arose because the previous code saved a full copy of the wordexp_t structure at entry and restored it wholesale on error. During partial processing the word list could be reallocated and moved; restoring the stale pointer left the caller with a dangling we_wordv while the newly allocated buffer was leaked. A later wordfree, or any other use of the list, could then free or read invalid memory.

Adhemerval Zanella's fix duplicates only the pointer array when WRDE_APPEND is set, so internal growth operates on the copy and the caller's original list stays valid. On non-NOSPACE errors the original word count and vector are left unchanged, matching the POSIX rule that WRDE_APPEND must not modify those fields on failure. Two older error-return paths that skipped cleanup were corrected at the same time.

DJ Delorie reviewed the change. New regression tests force reallocation on every growth so the dangling-pointer case is deterministic. The issue matters for any program that builds shell-style word lists incrementally and frees them after a failed append.