osd: fix pg ref leaks on shutdown

Two sources: pgbackend state, and timer events