mmc: fix use-after-free of struct request

We call mmc_req_is_special() after having processed a request, but
it could be freed after that. Check that ahead of time, and use
the cached value.

Reported-by: Hans de Goede <hdegoede@redhat.com>
Tested-by: Hans de Goede <hdegoede@redhat.com>
Fixes: c2df40df ("drivers: use req op accessor")

Signed-off-by: Jens Axboe <axboe@fb.com>