Fix oldMergedSS is altered to OUT_OF_SERVICE.

When there is no ImsPhone, oldMergedSS is assigned to mSST.mSS.
This caused "oldMergedSS", "tss" and "mNewSS" point to same object.
And when mNewSS.setStateOutOfService() is called, oldMergedSS is
also set to OUT_OF_SERVICE.

Test: Build pass;
Test: Add log and check oldMergedSS value pass;
Test: atest FrameworksTelephonyTests:ServiceStateTrackerTest

Bug: 112714563