libssh2_channel_process_startup: simplify the code

clang-analyzer pointed out how 'data' could be accessed as a NULL
pointer if the wrong state was set, and while I don't see that
happen in real-life the code flow is easier to read and follow by
moving the LIBSSH2_FREE() call into the block that is supposed to
deal with the data pointer anyway.

src/channel.c

@@ -1251,6 +1251,7 @@ _libssh2_channel_process_startup(LIBSSH2_CHANNEL *channel,
     }
 
     if (channel->process_state == libssh2_NB_state_sent) {
+        unsigned char code;
         rc = _libssh2_packet_requirev(session, reply_codes, &data, &data_len,
                                       1, channel->process_local_channel, 4,
                                       &channel->process_packet_requirev_state);
@@ -1262,14 +1263,14 @@ _libssh2_channel_process_startup(LIBSSH2_CHANNEL *channel,
                                   "Failed waiting for channel success");
         }
 
-        if (data[0] == SSH_MSG_CHANNEL_SUCCESS) {
+        code = data[0];
         LIBSSH2_FREE(session, data);
         channel->process_state = libssh2_NB_state_idle;
+
+        if (code == SSH_MSG_CHANNEL_SUCCESS)
             return 0;
     }
-    }
 
-    LIBSSH2_FREE(session, data);
     channel->process_state = libssh2_NB_state_idle;
     return _libssh2_error(session, LIBSSH2_ERROR_CHANNEL_REQUEST_DENIED,
                           "Unable to complete request for "