When a TLS handshake fails during a NFS-over-TLS
mount attempt, the socket was left around because
it needed to be dereferenced. The dereference was
not happening in clnt_vc_destroy() because ct_closeit
was not set to TRUE.

This patch moves the code that sets ct_closeit to TRUE
up to before the rpctls_connect() call, so that ct_closeit
is set to TRUE if it fails and clnt_vc_destroy() will then
dereference the socket.

Tested by doing NS-over-TLS mount attempts when
rpc.tlsservd was not running on the server and then
observing the status of the socket via "netstat -a"
after the mount fails.

Without this patch, the socket is left around in
CLOSED state.