cex: fix miscellaneous leaks

* src/counterexample.c (unifying_counterexample): Always free
stage3result when it exists.
* src/conflicts.c (report_state_counterexamples): free leaked bitset.
* src/state-item.c (prune_disabled_paths): free leaked queue.

src/state-item.c

@@ -449,6 +449,7 @@ prune_disabled_paths (void)
                   }
               }
             }
+          gl_list_free (queue);
         }
     }
 }