Fix payload memory leak (#22492)

fix(aclk): free cloud_to_agent.payload on v2 cmd success path aclk_handle_cloud_cmd_message parsed the cmd JSON into a local struct aclk_request. The error path freed payload, msg_id and callback_topic, but the v2 success path returned without freeing the JSON-parsed payload field. msg_id and callback_topic are transferred into the query and released by aclk_query_free; the v2 handler derives the HTTP body from the raw frame and never consumes the parsed payload, so it was leaked whenever the cmd JSON included a "payload" key. Free cloud_to_agent.payload after the success branch and document the ownership invariant on struct aclk_request so future field additions extend both cleanup paths.