free(3) the deprecation, sunset and link header values we get back from
curl after inserting them into the result JSON.

Handle them like we do for x_corr_id.

Fixes: 56aad55 ("Flow some extra response headers from HMRC through")
Signed-off-by: Andrew Clayton <ac@sigsegv.uk>

When the API scope is MTD_API_SCOPE_NULL
api_default_values[]->api_version (and ->api_name) will be NULL.

Passing NULL to snprintf(3) et al is undefined behaviour, we were lucky
in that we were getting "(null)" rather than a segfault.

In these cases we don't need to set api_ver_hdr as we don't set the
"Accept" header for "/oauth/token" urls.

Fixes: ab39737 ("This is basically a new version")
Signed-off-by: Andrew Clayton <ac@sigsegv.uk>