agent: fix agent message handling bugs.

It could happen that cleaning up a pending message in
agent_receive_message() would as a side effect zero service reference
count via driver context unref function pointer, and service cleanup
would call connman_agent_cancel() which would try to clean up the
pending message for the second time.

Fixed by decoupling the pointer to the pending request from the agent
structure before calling agent_request_free().

Also, added null message pointer handling to agent-connman.c callback
function request_input_login_reply().

[connman] Fix agent message handling bugs.