shared: fix a memory leak

```
$ ./src/test/test-systemd-tmpfiles.py valgrind --leak-check=full --error-exitcode=1 ./build/systemd-tmpfiles
...
Running valgrind --leak-check=full --error-exitcode=1 ./build/systemd-tmpfiles on 'w /unresolved/argument - - - - "%Y"'
...
[<stdin>:1] Failed to substitute specifiers in argument: Invalid slot
...
==22602== 5 bytes in 1 blocks are definitely lost in loss record 1 of 2
==22602==    at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==22602==    by 0x4ECA7D4: malloc_multiply (alloc-util.h:74)
==22602==    by 0x4ECA909: specifier_printf (specifier.c:59)
==22602==    by 0x113490: specifier_expansion_from_arg (tmpfiles.c:1923)
==22602==    by 0x1144E7: parse_line (tmpfiles.c:2159)
==22602==    by 0x11551C: read_config_file (tmpfiles.c:2425)
==22602==    by 0x115AB0: main (tmpfiles.c:2529)
```

1 files changed, 3 insertions, 2 deletions

diff --git a/src/shared/specifier.c b/src/shared/specifier.c
index 6839d1892d..69fefc8d00 100644
--- a/src/shared/specifier.c
+++ b/src/shared/specifier.c
@@ -101,10 +101,11 @@ int specifier_printf(const char *text, const Specifier table[], void *userdata,
 
                                         ret = n;
                                         t = n + j + k;
-                                } else if (strchr(POSSIBLE_SPECIFIERS, *f))
+                                } else if (strchr(POSSIBLE_SPECIFIERS, *f)) {
                                         /* Oops, an unknown specifier. */
+                                        free(ret);
                                         return -EBADSLT;
-                                else {
+                                } else {
                                         *(t++) = '%';
                                         *(t++) = *f;
                                 }