remote: Fix migration leaks

How to reproduce:

% valgrind -v --leak-check=full virsh migrate mig \
  qemu+ssh://$dest/system --unsafe

== 8 bytes in 1 blocks are definitely lost in loss record 1 of 28
==    at 0x4A04A28: calloc (vg_replace_malloc.c:467)
==    by 0x3EB7115FB8: xdr_reference (in /lib64/libc-2.12.so)
==    by 0x3EB7115F10: xdr_pointer (in /lib64/libc-2.12.so)
==    by 0x4D1EA84: xdr_remote_string (remote_protocol.c:40)
==    by 0x4D1EAD8: xdr_remote_domain_migrate_prepare3_ret (remote_protocol.c:4772)
==    by 0x4D2FFD2: virNetMessageDecodePayload (virnetmessage.c:382)
==    by 0x4D2789C: virNetClientProgramCall (virnetclientprogram.c:382)
==    by 0x4D0707D: callWithFD (remote_driver.c:4549)
==    by 0x4D070FB: call (remote_driver.c:4570)
==    by 0x4D12AEE: remoteDomainMigratePrepare3 (remote_driver.c:4138)
==    by 0x4CF7BE9: virDomainMigrateVersion3 (libvirt.c:4815)
==    by 0x4CF9432: virDomainMigrate2 (libvirt.c:5454)
==
== LEAK SUMMARY:
==    definitely lost: 8 bytes in 1 blocks
==    indirectly lost: 0 bytes in 0 blocks
==      possibly lost: 0 bytes in 0 blocks
==    still reachable: 126,995 bytes in 1,343 blocks
==         suppressed: 0 bytes in 0 blocks

This patch also fixes the leaks in remoteDomainMigratePrepare and
remoteDomainMigratePrepare2.

src/remote/remote_driver.c

@@ -1963,6 +1963,7 @@ remoteDomainMigratePrepare (virConnectPtr dconn,
     if (ret.uri_out)
         *uri_out = *ret.uri_out; /* Caller frees. */
 
+    VIR_FREE(ret.uri_out);
     rv = 0;
 
 done:
@@ -2018,6 +2019,7 @@ remoteDomainMigratePrepare2 (virConnectPtr dconn,
     rv = 0;
 
 done:
+    VIR_FREE(ret.uri_out);
     remoteDriverUnlock(priv);
     return rv;
 error:
@@ -4161,6 +4163,7 @@ remoteDomainMigratePrepare3(virConnectPtr dconn,
     rv = 0;
 
 done:
+    VIR_FREE(ret.uri_out);
     remoteDriverUnlock(priv);
     return rv;
 error: