librdmacm: cm_svc: don't dispatch stale CM events after add/remove

cm_svc_run() captures CM channel revents from poll(), then processes any
pending control-socket command via cm_svc_process_sock().  An RS_SVC_REM_CM
removes the rsocket from the svc set, after which the app thread's rclose()
proceeds to rs_free() concurrently.  The svc thread would then walk the CM
dispatch loop using the pre-remove revents and call rs_handle_cm_event() on
a freed rsocket, dereferencing rs->cm_id (NULL on reused memory) and
crashing in ucma_complete().  This is a use-after-free hit under open/close
stress (e.g. redis-benchmark via librspreload), and affects both connect_svc
and listen_svc, which share cm_svc_run().

After handling the control socket, continue back to poll() instead of
dispatching the now-stale CM revents.  Unread CM events keep the fd readable
and will re-fire on the next poll(), so no event is lost.  Also guard
rs_handle_cm_event() against a NULL cm_id as defense-in-depth.

Signed-off-by: Batsheva Black <bblack@nvidia.com>