When parsing `ioengine=external:/path`, `td->o.ioengine_so_path` was
previously assigned as a pointer directly into the `td->o.ioengine`
string buffer. If `td->o.ioengine` was subsequently reallocated (e.g.,
due to multiple ioengine definitions or the use of include directives),
`ioengine_so_path` became a dangling pointer, resulting in a
heap-use-after-free during `dlopen_ioengine`.

Fix this by ensuring `ioengine_so_path` owns its own memory allocation
independent of the `ioengine` string. Since this field is not defined
as a standard option entry, manual lifecycle management is implemented:

1.  **str_ioengine_external_cb**: Use `strdup` to store the path and
    free any previously allocated string.
2.  **fio_options_mem_dupe**: Explicitly duplicate the string when
    copying thread options.
3.  **fio_options_free**: Explicitly free the string when tearing down
    thread options.

This approach resolves the UAF while adhering to the requirement of not
adding a new option entry to the parser. Verified with ASan and existing
test suites.

Signed-off-by: Matthew Suozzo <[email protected]>