expr: fix a recently introduced memory leak

* src/expr.c (eval6): Free memory allocated by mbs_logical_substr().

Introduced in v8.27-47-ga9f2be5.  Detected by Coverity Analysis:

Error: RESOURCE_LEAK:
src/expr.c:851: leaked_storage: Variable "s" going out of scope
leaks the storage it points to.
849|             char *s = mbs_logical_substr (l->u.s, pos, len);
850|             v = str_value (s);
851|->         }
852|         freev (l);
853|         freev (i1);

src/expr.c

@@ -848,6 +848,7 @@ eval6 (bool evaluate)
 
           char *s = mbs_logical_substr (l->u.s, pos, len);
           v = str_value (s);
+          free (s);
         }
       freev (l);
       freev (i1);