json_c_set_serialization_double_format() freed the current format string
before strdup() of its replacement. In the GLOBAL branch the freed
pointer was not reset on the strdup() failure path, leaving it dangling:
a later serialization read through the dangling pointer, and a
subsequent set(NULL) call freed it a second time. The THREAD branch
reset its pointer to NULL right after the free, so it had no dangling
pointer; its only defect was that a strdup() failure silently dropped
the configured thread-local format and fell back to the global format.
strdup() the new format first and replace the old one only once it
succeeds, so a failure leaves both the global and thread-local format
exactly as they were before the call.
Fixes#997.
