ovl: fix copy-up in tmpfile

Move ovl_copy_up() call outside of ovl_want_write()/ovl_drop_write()
region, since copy up may also call ovl_want_write() resulting in recursive
locking on sb->s_writers.

Reported-and-tested-by:  <syzbot+85e58cdf5b3136471d4b@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/all/000000000000f6865106191c3e58@google.com/


Fixes: 9a87907d ("ovl: implement tmpfile")
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>