osd/ReplicatedPG: carry CopyOpRef in copy_from completion

There is a race with copy_from cancellation.  The internal Objecter 
completion decodes a bunch of data and copies it into pointers provided when
the op is queued.  When we cancel, we need to ensure that we can cope until
control passes back to our provided completion.

Once we *do* get into the (ReplicatedPG) callbacks, we will bail out because
the tid in the CopyOp or FlushOp no longer matches.

Fix this by carrying a ref to keep the copy-from targets alive, and clearing
out the tids that we cancel.

Note that previously, the trigger for this was that the tid changes when we
handle a redirect, which made the op_cancel() call fail.  With the coming
Objecter changes, this will no longer be the case.  However, there are also
locking and threading changes that will make cancellation racy, so we will
not be able to rely on it always preventing the callback. Either way, this
will avoid the problem.

Fixes: #7588 Signed-off-by: Sage Weil <sage@inktank.com>