core: unit: remove bus slot after calling unit_done()

The ->done callback in the unit's vtable might call into
unit_unwatch_bus_name() and corrupt memory by that.

Move the call down, and clean up the bus slot in case it hasn't been done
yet.

src/core/unit.c

@@ -478,11 +478,12 @@ void unit_free(Unit *u) {
         if (u->manager->n_reloading <= 0)
                 unit_remove_transient(u);
 
-        sd_bus_slot_unref(u->match_bus_slot);
         bus_unit_send_removed_signal(u);
 
         unit_done(u);
 
+        sd_bus_slot_unref(u->match_bus_slot);
+
         unit_free_requires_mounts_for(u);
 
         SET_FOREACH(t, u->names, i)