[connman] network: protect service structure access with reference

As __connman_connection_gateway_remove() may unref service, wrap
network.c:set_disconnected() with connman_service_ref/unref to make
sure the struct stays around during the function call.