osd/ReplicatedPG: carry CopyOpRef in copy_from completion

osd/ReplicatedPG: carry CopyOpRef in copy_from completion

There is a race with copy_from cancellation.  The internal Objecter
completion decodes a bunch of data and copies it into pointers provided
when the op is queued.  When we cancel, we need to ensure that we can cope
until control passes back to our provided completion.

Once we *do* get into the (ReplicatedPG) callbacks, we will bail out
because the tid in the CopyOp or FlushOp no longer matches.

Fix this by carrying a ref to keep the copy-from targets alive, and
clearing out the tids that we cancel.

Note that previously, the trigger for this was that the tid changes when
we handle a redirect, which made the op_cancel() call fail.  With the
coming Objecter changes, this will no longer be the case.  However, there
are also locking and threading changes that will make cancellation racy,
so we will not be able to rely on it always preventing the callback.
Either way, this will avoid the problem.

Fixes: #7588
Signed-off-by: Sage Weil <sage@inktank.com>