Null the multi SEXP packet getters' out-pointers on failure (#7828)

get_ship(), get_wing(), get_object() and get_parse_object() only assigned
their out-pointer on success. When a lookup failed (no bytes left, or a net
signature that no longer resolves, e.g. a ship destroyed before the packet
was processed) the caller's uninitialized local was left as stack garbage,
so its nullptr check could pass and the next line would write through it.
multi_sexp_set_camera_target() used the object without checking at all.

Set the out-pointer to nullptr up front, so every caller's existing nullptr
check works. This also clears the C4701/C4703 "potentially uninitialized"
warnings MSVC 2026 reports for the callers in sexp.cpp when it inlines these
getters at link time.

code/network/multi_sexp.cpp

@@ -482,6 +482,7 @@ bool sexp_network_packet::get_ship(int & value)
 bool sexp_network_packet::get_ship(ship *& shipp)
 {
     int shipnum;
+    shipp = nullptr;
 
     if (get_ship(shipnum)) {
         shipp = &Ships[shipnum];
@@ -495,6 +496,7 @@ bool sexp_network_packet::get_wing(wing *& wingp)
 {
 	int i;
     ushort netsig;
+    wingp = nullptr;
 
     if (!sexp_bytes_left || !current_argument_count) {
         return false;
@@ -519,6 +521,7 @@ bool sexp_network_packet::get_wing(wing *& wingp)
 bool sexp_network_packet::get_object(object *& value)
 {
     ushort netsig;
+    value = nullptr;
 
     if (!sexp_bytes_left || !current_argument_count) {
         return false;
@@ -541,6 +544,7 @@ bool sexp_network_packet::get_object(object *& value)
 bool sexp_network_packet::get_parse_object(p_object *& pobjp)
 {
     ushort netsig;
+    pobjp = nullptr;
 
     if (!sexp_bytes_left || !current_argument_count) {
         return false;