msgr: ref count Pipe to avoid use after free

msgr: ref count Pipe to avoid use after free

The Connection has a Pipe pointer to facilitate
 send_message(Message, Connection)
but the reaper() clears that pointer when tearing down old pipes.  This
leads to a race in which submit_message dereferences the old Pipe pointer.

Instead, make Pipe ref counted, and only submit_message() if we get a
valid Pipe reference.  This fixes races between send_message() and
reaper() (as well as any use of the Connection after the pipe is closed).

Signed-off-by: Sage Weil <sage@newdream.net>