CVE-2019-16881: Use after free in portaudio-rs

The vulnerability stems from improper panic safety in C callback handlers. Both functions:

1. Used mem::transmute to convert raw pointers to Boxes
2. Called user-provided Rust closures (which might panic)
3. Relied on mem::forget AFTER the closure execution to prevent deallocation

If the closure panicked before mem::forget, the Box would be dropped normally, freeing memory while PortAudio might retain the callback pointer. The commit diff shows the fix replaced this pattern with Box::leak/Box::from_raw, eliminating the panic-sensitive mem::forget sequence.