cas: manually clear strong ref before callback

Hidl doesn't guarantee the server side method goes out of scope
before the client side returns. Even when client calls on the
same thread, the next method could overlap the previous call.
Next call can come in as soon as the hidl callback is called.

In case of openSession and release, there is a rare chance that
release call comes in before previous openSession is returned.
If this happens, the cas plugin object destructor is delayed to
the point when openSession goes out of scope (thus let go its
strong ref to the plugin). This violates our contract that the
plugin object and all associated sessions are released by the
time release() returns.

Manually clean up the strong ref before calling hidl callback
in openSession would fix this.

bug: 70544685
Change-Id: Id89a00591a354c8a46def3cc691dd8e28b4c971b