gossipd: fix crash when we prune old, un-updated channel announcements.

We added a random channel to the list, but we can just free it immediately
(since traversal of a uintmap isn't altered by deletion).

This was introduced in d1f43d993a where we explicitly call free_chan
rather than relying on destructors.

Fixes: #2837
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

gossipd/routing.c

@@ -2476,12 +2476,10 @@ void route_prune(struct routing_state *rstate)
 	/* Anything below this highwater mark ought to be pruned */
 	const s64 highwater = now - rstate->prune_timeout;
 	struct chan **pruned = tal_arr(tmpctx, struct chan *, 0);
-	struct chan *chan;
-	struct unupdated_channel *uc;
 	u64 idx;
 
 	/* Now iterate through all channels and see if it is still alive */
-	for (chan = uintmap_first(&rstate->chanmap, &idx);
+	for (struct chan *chan = uintmap_first(&rstate->chanmap, &idx);
 	     chan;
 	     chan = uintmap_after(&rstate->chanmap, &idx)) {
 		/* Local-only?  Don't prune. */
@@ -2507,11 +2505,12 @@ void route_prune(struct routing_state *rstate)
 	}
 
 	/* Look for channels we had an announcement for, but no update. */
-	for (uc = uintmap_first(&rstate->unupdated_chanmap, &idx);
+	for (struct unupdated_channel *uc
+		     = uintmap_first(&rstate->unupdated_chanmap, &idx);
 	     uc;
 	     uc = uintmap_after(&rstate->unupdated_chanmap, &idx)) {
 		if (uc->added.ts.tv_sec < highwater) {
-			tal_arr_expand(&pruned, chan);
+			tal_free(uc);
 		}
 	}