ng_l2tp: Fix callout synchronization in the rexmit timeout handler

ng_l2tp: Fix callout synchronization in the rexmit timeout handler

A received control packet may cause the transmit queue to be flushed, in
which case ng_l2tp_seq_recv_nr() cancels the transmit timeout handler.
The handler checks to see if it was cancelled before doing anything, but
did so before acquiring the node lock, so a small race window could
cause ng_l2tp_seq_rack_timeout() to attempt to flush an empty queue,
ultimately causing a null pointer dereference.

PR:		241133
Reviewed by:	bz, glebius, Lutz Donnerhacke
MFC after:	3 days
Sponsored by:	Rubicon Communications, LLC (Netgate)
Differential Revision:	https://reviews.freebsd.org/D26548