Regression in unreleased version.

Leak caused by corrupt password file, only occurring on startup or
reload.

Unreleased code, so minor impact.

Embedded 0 characters in a file would prevent the loading of that file.

This could not happen apart from corruption of the file, or by
deliberate manipulation by the admin. Minimal impact.

Leak on startup and reload only, assuming a corrupt password file
provided by the admin. Minimal impact.

Memory leak regression in unreleased code.

If the person creating the mosquitto.conf duplicates the
tls_engine_kpass_sha1 option, there was a memory leak.

Minimal impact, no security risk.