hyperv/vmbus: Fix the multi-channel revoking on vmbus side.

[sepherosa_gmail.com]

Summary

• Reference count the sub-channel when channel offer message is processed, so that immediate rescind message on the same channel will not race sub-channel open on driver side.
• Drop the above reference when sub-channel is closed, this closely mimics the hypervisor's reaction when primary channel is closed on the VM side. No drivers use sub-channel after primary channel is closed.