mailbox: tegra-hsp: Use after free in tegra_hsp_remove_doorbells()

We have to use the _safe version of list_for_each() because we're
freeing the pointer as we go along.  (This might not show up testing
depending on what config options you have enabled).

Fixes: 0fe88461 ("mailbox: Add Tegra HSP driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>