bug: scope Rust FFI argument and result ownership

[Andiveli]

Problem

Rust-to-C JID arguments are converted with raw CString ownership even though Go only borrows them through C.GoString. Empty FFI query results can also expose a null pointer with zero length to Rust slice decoding.

Reproduction or motivating example

1. Call a bridge query or outbound send that passes a JID from Rust to Go.
2. Repeat the operation and observe that the raw CString allocation has no matching release.
3. Request contacts when Go returns an empty {nil, 0} result.

Expected behavior

Borrowed FFI arguments remain owned by Rust for the duration of the call, and empty results decode safely without constructing a slice from a null pointer.

Actual behavior

JID conversion transfers ownership without a matching free, and empty result decoding does not explicitly guard the null/zero case.

Relevant evidence

Affected code is in whatsrust/src/models.rs, whatsrust/src/queries.rs, and whatsrust/src/message_send.rs.

Acceptance criteria

• JID C strings have scoped Rust ownership across every FFI call.
• The public ABI remains unchanged.
• Empty contact results decode as an empty collection safely.
• Focused Rust tests cover ownership and empty-result behavior.