Crash when shutting down library while having subscription transactions on going

[nanang]

Scenario:

1. send SUBSCRIBE, no response from server yet
2. user decides to exit app, app sends un-SUBSCRIBE for the same evsub session, also no response from server yet
3. while both SUBSCRIBE transactions haven't timed out yet, app shuts down the lib using pjsua_destroy2(PJSUA_DESTROY_NO_RX_MSG)
4. crash with call stack trace points to cancellation of a transaction timer entry

Investigation found that there is a possibility of uncancelled timer entry after its memory pool has been released. An evsub session can only have one pending UAC SUBSCRIBE, so if there are two of them, it will terminate the older one using zero timeout timer to avoid deadlock. Unfortunately, the timer may never be executed nor cancelled if the library is shutting down without polling events, i.e: when PJSUA_DESTROY_NO_RX_MSG is specified. So when the evsub session and the dialog are destroyed, the timer which is allocated using dialog pool, becomes invalid and eventually causes crash whenever accessed (e.g: cancelling other timer entry).

Thanks Marcus Froeschl for the report.

[nanang]

In 4969:

Fixed #1807: Crash when shutting down library while having subscription transactions on going.