test_single_onion_poisoning: Free dir[12] on all paths

Coverity doesn't like it when there are paths to the end of the
function where something doesn't get freed, even when those paths
are only reachable on unit test failure.

Fixes CID 1372899 and CID 1372900. Bug not in any released Tor.

src/test/test_hs.c

@@ -765,6 +765,8 @@ test_single_onion_poisoning(void *arg)
   tt_assert(ret == 0);
 
  done:
+  tor_free(dir1);
+  tor_free(dir2);
   /* The test harness deletes the directories at exit */
   smartlist_free(services);
   rend_service_free(service_1);