Freed-memory read via stale JSON decoder pointer

Use-after-free in Vim 9.2.0511 through 9.2.0843 allows local users to trigger a freed-memory read with split malformed JSON. json_decode_item() retains a pointer into the old read buffer after json_decode_string() invokes channel_fill() to join queued bytes, replace the buffer, and free the original allocation; the error formatter then reads through that stale pointer. Reachability requires JSON channel decoding and a peer that splits an invalid string across buffers; the read is not returned to that peer, but an unmapped allocation ends the process and can discard unsaved changes.