tm: always use UAC buffer for To-URI when building relayed CANCEL

Regardless of the setting of the FL_USE_UAC_TO msg flag, there doesn't
seem to be any reason to use the UAS To-URI if the UAC buffer contains a
different one; this is suggested by the comment, "/* build the CANCEL
from the INVITE which was sent out/*" indicating the UAC buffer version
of the INVITE, not the INVITE that was originally received.
tm: add comments for CANCEL to-URI from UAC buffer fix
Merge pull request #2 from mraccident/flowroute-3.3

tm: always use UAC buffer for To-URI when building relayed CANCEL