io_uring/poll: add hash if ready poll request can't complete inline

If we don't, then we may lose access to it completely, leading to a
request leak. This will eventually stall the ring exit process as
well.

Cc: stable@vger.kernel.org
Fixes: 49f1c68e ("io_uring: optimise submission side poll_refs")
Reported-and-tested-by:  <syzbot+6c95df01470a47fc3af4@syzkaller.appspotmail.com>
Link: https://lore.kernel.org/io-uring/0000000000009f829805f1ce87b2@google.com/


Suggested-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>