do_last(): fetch directory ->i_mode and ->i_uid before it's too late

may_create_in_sticky() call is done when we already have dropped the
reference to dir.

Fixes: 30aba6656f61e (namei: allow restricted O_CREAT of FIFOs and regular files)
Change-Id: Id65803d12ab3643aec2d10e563e2aa351b7d60ad
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>