ion: destroy ion handles under client->lock

ion handles associated with a client must be destroyed
under client->lock so as to prevent race where other path
use handle while being destroyed.

One such path is when user access heap details through
debugfs.

   |rb_next()
   |ion_debug_heap_total(inline)
   |ion_debug_heap_show()
   |seq_read()

CRs-Fixed: 1000492
Change-Id: I7bc7562400df0ae08b1aa232efe00b657339fcfb
Signed-off-by: Shiraz Hashim <shashim@codeaurora.org>