lagg: Fix a teardown race

When a lagg interface is destroyed, it destroys all of the lagg ports,
which triggers an asynchronous link state change handler.  This in turn
may generate a netlink message, a portion of which requires netlink to
invoke the SIOCGIFMEDIA ioctl of the lagg interface, which involves
scanning the list of interface media.  This list is not internally
locked, it requires the interface driver to provide some kind of
synchronization.

Shortly after the link state notification has been raised, the lagg
interface detaches itself from the network stack.  As a part of this, it
blocks in order to wait for link state handlers to drain, but before
that it destroys the interface media list.  Reverse this order of
operations so that the link state change handlers drain first, avoiding
a use-after-free that is very occasionally triggered by lagg stress
tests.  This matches other ethernet drivers in the tree.

MFC after:	2 weeks

sys/net/if_lagg.c

@@ -643,8 +643,8 @@ lagg_clone_destroy(struct if_clone *ifc, struct ifnet *ifp, uint32_t flags)
 
 	switch (ifp->if_type) {
 	case IFT_ETHER:
-		ifmedia_removeall(&sc->sc_media);
 		ether_ifdetach(ifp);
+		ifmedia_removeall(&sc->sc_media);
 		break;
 	case IFT_INFINIBAND:
 		infiniband_ifdetach(ifp);