tcsh: fix abort in cleanup_until(), caused by internal xgetpass()

The xgetpass() function pushes a cleanup entry for &osa, but then
attempts to flush the stack until an entry matching &sa.  The two
object pointers do not match, so the stack is popped too much,
and then cleanup_until calls abort() when it unexpectedly hits
the bottom of the cleanup stack.

Reported by:	Paul B. Mahol, onemda at gmail.com,
		Pietro Cerutti, gahr at gahr.ch
PR:		bin/124191
Reviewed by:	mp, kris
MFC after:	2 days

contrib/tcsh/tc.func.c

@@ -632,7 +632,7 @@ xgetpass(const char *prm)
     }
     strbuf_terminate(&pass);
 
-    cleanup_until(&sa);
+    cleanup_until(&osa);
 
     return pass.s;
 }