Fix use of uninitialised variable and hostmask matching logic in userhost_unban()

Initialise ip_str so that it isn't used uninitialised.

Don't strip server flags from user@ portion of the hostmask, so that it will
not miss matching bans.

Switch ip_str from alloca() to malloc_sprintf() / new_free() - there's no
particular need for alloca() here.

Changelog

@@ -1,5 +1,8 @@
 [Changes 1.2.2]
 
+* Fix potential crash in /unban, and change it so that it correctly matches
+  the user@ portion of the hostmask.
+
 * Clean up the build by fixing up the (unsigned char *) / (char *) mismatches
   that the compiler warns about. (caf)