tests: test-qmp-commands: Fix double free

The ret variable is freed twice, but on the second time we actually want
to free ret3 instead. Don't know why this didn't explode.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
