jail: Fix a race in prison_deref()

[markj]

Summary

If we're killing a jail which has some user refs pending, then we would
first drop our ref and then kill all processes in the prison. However,
it's possible for the prison to be freed before we finish that
operation, generally if the processes exit on their own before
prison_proc_iterate() returns.

Thus, defer the release of the prison refcount until after we've killed
all procs.

[jamie]

Yes, I'm referring to a prison I don't hold a reference to, without allprison_lock held. My bad. This look good, with the common path not adding any extra steps.