net: fix poll() abort on net channels

While the net channel poller list (a vector<pollreq>) is managed via rcu,
do_poll() modifies the pollreq without protection when it clears
pollreq::_poll_thread.  This can cause net_channel::wake_pollers() to wake
a null thread.

Fix by converting pollreq::_poll_thread to a sched::thread_handle (which has
internal rcu protection).

Seen running wrk against a static tomcat page (the home page).

Reviewed-by: Nadav Har'El <nyh@cloudius-systems.com>
Signed-off-by: Avi Kivity <avi@cloudius-systems.com>
Signed-off-by: Pekka Enberg <penberg@cloudius-systems.com>