virtio-scsi: Handle TMF request cancellation asynchronously

For VIRTIO_SCSI_T_TMF_ABORT_TASK and VIRTIO_SCSI_T_TMF_ABORT_TASK_SET,
use scsi_req_cancel_async to start the cancellation.

Because each tmf command may cancel multiple requests, we need to use a
counter to track the number of remaining requests we still need to wait
for.

Signed-off-by: Fam Zheng <famz@redhat.com>
[Put "remaining" field into VirtIOSCSIReq, avoid double visit of the
 requests list. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>