client: fix Client::handle_cap_flushsnap_ack() crash

client: fix Client::handle_cap_flushsnap_ack() crash

Struct CapSnap holds a reference to its parent inode. So erasing
struct CapSnap from Inode::cap_snaps may drop inode's last reference.
The inode gets freed in the middle of erasing struct CapSnap

Fixes: http://tracker.ceph.com/issues/18460
Signed-off-by: Yan, Zheng <zyan@redhat.com>
(cherry picked from commit 525c52fd491ed1ced385c8047872e3f557f8423f)

Conflicts:
	src/client/Client.cc (jewel does in->cap_snaps.erase(follows), master
                             does not; put it after the tmp_ref assignment)