[AppSec] Free the WAF diagnostics of every config applied to the builder

ddwaf_builder_add_or_update_config allocates a fresh diagnostics object on
every call and overwrites the one it is given without freeing it, so reusing
a single object across the loop leaked all but the last one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: dromanol

tracer/src/Datadog.Trace/AppSec/Waf/Initialization/WafConfigurator.cs

@@ -251,10 +251,18 @@ internal UpdateResult Update(IntPtr wafBuilderHandle, ConfigurationState configu
                             {
                                 var configObj = encoded.ResultDdwafObject;
                                 var path = config.Key;
-                                if (!_wafLibraryInvoker.BuilderAddOrUpdateConfig(wafBuilderHandle, path, ref configObj, ref diagnostics))
+
+                                // the WAF allocates a fresh diagnostics object on every call and overwrites the
+                                // one it is given without freeing it, so it can't be reused across the loop: only
+                                // the last one is reported, the previous ones have to be released here or they leak
+                                var configDiagnostics = default(DdwafObjectStruct);
+                                if (!_wafLibraryInvoker.BuilderAddOrUpdateConfig(wafBuilderHandle, path, ref configObj, ref configDiagnostics))
                                 {
                                     Log.Debug("WAF builder: Config failed to load : {0}", path); // Check were all these error codes are defined
                                 }
+
+                                _wafLibraryInvoker.ObjectDestroy(ref diagnostics);
+                                diagnostics = configDiagnostics;
                             }
                         }
                     }