Fix extension state callback references in chan_sip.

Chan_sip gives a dialog reference to the extension state callback and
assumes that when ast_extension_state_del() returns, the callback cannot
happen anymore.  Chan_sip then reduces the dialog reference count
associated with the callback.  Recent changes (ASTERISK-17760) have
resulted in the potential for the callback to happen after
ast_extension_state_del() has returned.  For chan_sip, this could be very
bad because the dialog pointer could have already been destroyed.

* Added ast_extension_state_add_destroy() so chan_sip can account for the
sip_pvt reference given to the extension state callback when the extension
state callback is deleted.

* Fix pbx.c awkward statecbs handling in ast_extension_state_add_destroy()
and handle_statechange() now that the struct ast_state_cb has a destructor
to call.

* Ensure that ast_extension_state_add_destroy() will never return -1 or 0
for a successful registration.

* Fixed pbx.c statecbs_cmp() to compare the correct information.  The
passed in value to compare is a change_cb function pointer not an object
pointer.

* Make pbx.c ast_merge_contexts_and_delete() not perform callbacks with
AST_EXTENSION_REMOVED with locks held.  Chan_sip is notorious for
deadlocking when those locks are held during the callback.

* Removed unused lock declaration for the pbx.c store_hints list.

(closes issue ASTERISK-18844)
Reported by: rmudgett

Review: https://reviewboard.asterisk.org/r/1635/
........

Merged revisions 348940 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 348952 from http://svn.asterisk.org/svn/asterisk/branches/10


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@348953 65c4cc65-6c06-0410-ace0-fbb531ad65f3