nvmf: Always use xpt_done instead of xpt_done_direct

The last reference on a pending I/O request might be held by an mbuf
in the socket buffer.  When this mbuf is freed, the I/O request is
completed which triggers completion of the CCB.  However, this can
occur with locks held (e.g. with so_snd locked when the mbuf is freed
by sbdrop()) raising a LOR between so_snd and the CAM device lock.
Instead, defer CCB completion processing to a thread where locks are
not held.

Sponsored by:	Chelsio Communications

sys/dev/nvmf/host/nvmf_sim.c

@@ -58,7 +58,7 @@ nvmf_ccb_done(union ccb *ccb)
 		xpt_done(ccb);
 	} else {
 		ccb->ccb_h.status = CAM_REQ_CMP;
-		xpt_done_direct(ccb);
+		xpt_done(ccb);
 	}
 }