uclient: cancel state change timeout in uclient_disconnect()
When the uloop is ended right after the state change timeout has been
armed, the timeout will never be cancelled, without a way for the
libuclient user to clean up. When uclient_free() is then called on the
uclient context while the uloop is still live, the entry in uloop's timeout
list will be dangling, often resulting in a segfault when new timeouts are
added or the timeout list is cleaned up in uloop_done().
Fix this by cancelling the timeout in uclient_disconnect().
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>