Call scp_session_destroy() in the functions that call
scp_session_create() and nowhere else.
As found by Valgrind, the session data is not freed if the session is
created successfully.
Using the same argument for binary and text data is not a good idea. If
string support is ever needed, it should be a separate function.
Remove SCP_ADDRESS_TYPE_IPV4_BIN and SCP_ADDRESS_TYPE_IPV6_BIN, use
SCP_ADDRESS_TYPE_IPV4 and SCP_ADDRESS_TYPE_IPV6, which simplifies the
code.
Notes about software design should not be shown as warnings to everybody
who compiles the code. Warnings should be about unexpected conditions
detected at the compile time.