network: implement refcounting for SR-IOV objects

link_request_sr_iov_vfs() queued each request with a raw SRIOV* as
userdata and a NULL free_func, so the request did not own the object.
The SRIOV is owned by link->network->sr_iov_by_section, which is freed
by network_free() on reload while the RTM_SETLINK reply may still be in
flight (the floating netlink slot keeps the request alive but does not
keep the userdata alive). A later reply, or the 25s netlink timeout,
then dispatches sr_iov_handler() which reads the freed SRIOV.

Follow-up for cb8453cc51

src/network/networkd-sriov.c

@@ -98,11 +98,12 @@ int link_request_sr_iov_vfs(Link *link) {
                         if (!sr_iov_has_config(sr_iov, attr))
                                 continue;
 
+                        /* The request takes a reference on the configuration. */
                         r = link_queue_request_safe(
                                         link,
                                         _REQUEST_TYPE_SRIOV_BASE + attr,
                                         sr_iov,
-                                        NULL,
+                                        sr_iov_unref,
                                         sr_iov_hash_func,
                                         sr_iov_compare_func,
                                         sr_iov_process_request,
@@ -113,6 +114,8 @@ int link_request_sr_iov_vfs(Link *link) {
                                 return log_link_warning_errno(link, r,
                                                               "Failed to request to set up %s for SR-IOV virtual function %"PRIu32": %m",
                                                               sr_iov_attribute_to_string(attr), sr_iov->vf);
+                        if (r > 0)
+                                sr_iov_ref(sr_iov);
                 }
         }