make list iterator functions safe against removal of entry

Removing entries in non-safe list iterators causes severe bugs and
they are usually difficult to find.  This makes all the iterator
functions safe against removal of list entries in exchange for a very
small overhead.

Signed-off-by: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Signed-off-by: Liu Yuan <namei.unix@gmail.com>
split list_head into list_head and list_node

Currently, we are abusing struct list_head for both list head and list
elements.  This patch introduces struct list_node and uses it for a
list element to make list operations easier to understand.  E.g. we
are using list_del_init() to remove a list element and list_empty() to
check the element is linked to a list.  With this patch, we use
list_del() to remove an element and list_linked() to check the element
is linked.

Signed-off-by: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Signed-off-by: Liu Yuan <namei.unix@gmail.com>