fzap_cursor_move_to_key() should drop l_rwlock

Callers of zap_deref_leaf() must be careful to drop leaf->l_rwlock
since that function returns with the lock held on success.  All other
callers drop the lock correctly but it seems fzap_cursor_move_to_key()
does not.  This may block writers or cause VERIFY failures when the
lock is freed.

Fixes #1215
Fixes zfsonlinux/spl#143
Fixes zfsonlinux/spl#97