Fix double free in pipe_t::process_pipe_term_ack

[ssam18]

The _in_pipe pointer was being used to drain messages and then deleted via LIBZMQ_DELETE, but the command dispatch loop in io_thread_t::in_event processes all mailbox commands in a single pass. If a second command arrives for the same pipe_t after delete this is executed, the object's memory has already been freed and _in_pipe becomes a dangling pointer, leading to a double free.

This fix saves _in_pipe to a local and nulls out the member before draining, so any stale access to the deleted object sees NULL rather than a freed ypipe pointer. Fixes #4806.