Also fix some errors in vcl0 handling:

- Only the top request may release vcl0 because it owns it
- because we can re-embark for ESI, we can not assert that vcl0 is NULL
  in CNT_Embark()

passes tests/r02849.vtc again.

still fails r03003.vtc, which will get fixed in a follow up commit

Fixes #3019 with test case by @Dridi