splice: Fix leaks that can happen when initiating a splice

• change the state to SPLICE_EXCEPTION to allow so_unsplice() to work to cleanup failed splices (fixes socket reference leak)
• NULL out sp->dst when unsplicing from so_splice() before so2 has been been referenced.
• Deal with a null sp->dst / so2 in so_unsplice
• Fix asserts that talked about sp->state == SPLICE_INIT; that state is not possible here.

Differential Revision: https://reviews.freebsd.org/D54157
Reviewed by: markj
Sponsored by: Netflix
Fixes: c0c5d01e5374 ("so_splice: Synchronize so_unsplice() with so_splice()")
MFC after: 3 days

(cherry picked from commit a837d1fe49e0255d81c670dc271ff245ae960097)