usb: dwc3: Handle race between remove_request and ep_dequeue

Commit 3ef97296 ("usb: dwc3: gadget: Handle race between
remove_request & ep_dequeue") was introduced to fix the race
between remove_requests & dequeue process,but it exposes a new
issue where we see crash on ep_set_halt where the started list
gets corrupted since composite cleanup already did a free_req.

Fix this by reverting the older patch and handling the race
of remove_requests & dequeue in cleanup_cancelled_request
by iterating over the list using while loop which will insure
to access the first node from list_head.

Change-Id: I727ca54e5ac839ceb55efb644a7cd8d514db63b6
Signed-off-by: Udipto Goswami <ugoswami@codeaurora.org>