vmm: release the lock when vrtc_snapshot() fails

[wanpengqian_gmail.com]

Summary

The error path of the SNAPSHOT_*_OR_LEAVE() macros jumped past
VRTC_UNLOCK() and returned with the vrtc lock held.

Signed-off-by: Wanpeng Qian <[e-mail]>
Sponsored by: keelos.dev

Test Plan

By inspection. Compile-tested on main (f958aa7e7); the error path is not taken in normal use (it needs a snapshot buffer that is too small).