group: disconnect pending reveal timeout in destructor to fix UAF

With reveal-delay set, handleMouseEnter arms a Glib::signal_timeout that
captures 'this'. sigc::connection's destructor does not remove the GLib
source, so a Group destroyed with a pending reveal timer would fire the
timeout on freed memory. Add a destructor that disconnects reveal_timeout_.

include/group.hpp

@@ -14,7 +14,7 @@ class Group : public AModule {
 
  public:
   Group(const std::string&, const std::string&, const Json::Value&, bool);
-  ~Group() override = default;
+  ~Group() override;
   auto update() -> void override;
   operator Gtk::Widget&() override;
 

src/group.cpp

@@ -105,6 +105,14 @@ Group::Group(const std::string& name, const std::string& id, const Json::Value&
   event_box_.add(box);
 }
 
+Group::~Group() {
+  // Disconnect any pending reveal timeout so it cannot fire on a destroyed
+  // instance (the GLib source is not removed by sigc::connection's destructor).
+  if (reveal_timeout_.connected()) {
+    reveal_timeout_.disconnect();
+  }
+}
+
 void Group::show_group() {
   box.set_state_flags(Gtk::StateFlags::STATE_FLAG_PRELIGHT);
   revealer.set_reveal_child(true);