curlhttpsrc: fix various leaks

Using Valgrind has shown up race conditions and memory leaks in curlhttpsrc:

1. gst_curl_http_src_change_state() does not wait for the multi_loop
   to complete before going to the NULL state, which means that
   an instance of GstCurlHttpSrc can be released while
   gst_curl_http_src_curl_multi_loop() still has a reference to it.
2. if multiple elements try to be removed from the queue at once,
   only the last one is deleted.
3. source->caps is leaked
4. curl multi_handle is leaked
5. leak of curl_handle if URI not set
6. leak of http_headers when reusing element
7. null pointer dereference in negotiate caps
8. double-free of the default user-agent string
9. leak of multi_task_context.task

Fixes #876 (closed)