rpcrt4: Fix a memory leak caused by NdrFullPointerXlatFree not freeing the entries in the full pointer translation table.

kernel32: Pass HEAP_ZERO_MEMORY to HeapAlloc() instead of clearing the memory with a separate memset() call.

mshtml: Use the correct deallocator in the htmldoc tests for the memory returned by IMoniker_GetDisplayName and fix a use-after-free error.

As per the rules for memory in RPC, the memory pointer to by object will 
be used during unmarshalling and previously it was uninitialised.
(Thanks to Dan Kegel and his Valgrind runs for reporting this.)

rpcrt4: Set the memory pointer in NdrBaseTypeUnmarshall to the buffer if we're unmarshalling on a server without memory being passed in.