user-accounts: Fix memory corruption in the avatar popup

Use g_object_set_data_full and g_steal_pointer to ensure the validity of the "filename" association.

Closes: #399 (closed)