sctp: Hold association locks across socket wakeups when freeing

[markj]

Summary

At this point we do not hold the inpcb lock, so the only thing holding
the socket reference live is the TCB lock, which needs to be acquired by
sctp_inpcb_free() in order to destroy associations. Defer the unlock
until after we dereference the socket reference.

Reported by: [e-mail]
Reported by: [e-mail]