Crash if ICE session is destroyed by the application inside "on_ice_complete" with an PJ_ICE_STRANS_OP_NEGOTIATION op callback (thanks John Ridges for the report)

[bennylp]

​http://lists.pjsip.org/pipermail/pjsip_lists.pjsip.org/2009-October/009063.html:

In PJNATH, destroying the ICE transport whilst inside
"on_ice_complete" with an PJ_ICE_STRANS_OP_NEGOTIATION op causes a crash. It
seems that the on_ice_complete callback is invoked in the "on_timer"
function in ice_session.c with the ice->mutex held, and deleting the
transport deletes the mutex, so when the callback returns the function
attempts to unlock the deleted mutex (and hilarity ensues). Perhaps the
mutex should be released before calling the callback.

[bennylp]

Fixed in r2948