fix(api): nvim_set_hl crashes when url= key is passed

Problem: Calling nvim_set_hl() with url= crashes because it tries to
free arena-owned string memory.

Solution: Remove the bad free and return a validation error instead.
(cherry picked from commit d19dc6339d)

test/functional/api/highlight_spec.lua

@@ -238,6 +238,10 @@ describe('API: set highlight', function()
     )
     assert_alive()
   end)
+  it("'url' is rejected with an error #38162", function()
+    eq("Invalid Key: 'url'", pcall_err(api.nvim_set_hl, 0, 'Test', { url = 'https://example.com' }))
+    assert_alive()
+  end)
 end)
 
 describe('API: get highlight', function()