cm: address race condition in afs_QueueVCB

cm: address race condition in afs_QueueVCB

Access the vcache callback member after taking
the xvcb lock to avoid the server object from
being freed in FlushServer on another thread.

Eventually, we should have a ref count on
avc->server.

FIXES 125596

Change-Id: I760819b1632d0e8188eaa34531239951aab980d3
Reviewed-on: http://gerrit.openafs.org/800
Reviewed-by: Simon Wilkinson <sxw@inf.ed.ac.uk>
Reviewed-by: Derrick Brashear <shadow@dementia.org>
Tested-by: Derrick Brashear <shadow@dementia.org>