target/riscv: Fix memory leak in riscv_trigger_unrealize()

In riscv_trigger_unrealize(), the per-trigger QEMUTimer objects are created in riscv_trigger_realize() using timer_new_ns(). However, unrealize only calls timer_del() to cancel them, but never frees the timer objects themselves. This results in a memory leak every time a CPU instance is unrealized (e.g., during hot-unplug or machine teardown). Fix it by replacing timer_del() with timer_free(), which internally cancels the timer and frees its memory. The separate timer_del() call is no longer needed. Fixes: 820552a92e32 ("target/riscv: dynamic alloc of debug trigger arrays") Signed-off-by: Zeng Chi <zengchi@kylinos.cn> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Message-ID: <20260724063927.3360599-1-zeng_chi911@163.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>