usb: cdc-wdm: Fix order in disconnect and fix locking

- as the callback can schedule work, URBs must be killed first
- if the driver causes an autoresume, the caller must handle locking

Signed-off-by: Oliver Neukum <neukum@b1-systems.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>