io_uring: io_async_cancel() should pass in 'nxt' request pointer

If we have a linked request, this enables us to pass it back directly
without having to go through async context.

Signed-off-by: Jens Axboe <axboe@kernel.dk>