Camera: Fix use-after-free bug in Camera3OutputStream

- The call to Camera3IOStreamBase::returnAnyBufferLocked can
result in Camera3OutputStream's destruction. This can cause
a use-after-free error when the calling function continues
execution to update the member variables.
- This fix uses an sp to keep the stream in scope for the
call to returnBuffer

Test: Camera CTS
Bug: 420614424
Flag: EXEMPT bug fix
Change-Id: Ib25a4683fd25a78a21ee7d20d4a5d0d2a4a7e087