Fix two issues in the shmem buffer maple tree usage:

1) ublk_buf_cleanup() iterates the tree with mas_for_each() without
   holding rcu_read_lock or mas_lock, triggering a lockdep splat on
   CONFIG_PROVE_RCU kernels. Add mas_lock/unlock around the iteration.

2) __ublk_ctrl_unreg_buf() calls unpin_user_pages() under mas_lock
   (a spinlock). unpin_user_pages can be expensive for large buffers
   and may take additional locks if folio refcount drops to zero.
   Restructure to drop mas_lock before unpinning, re-acquiring it
   to continue iteration.

Both functions now use the same pattern: erase under lock, drop lock,
unpin and free, re-lock to continue. Extract ublk_unpin_range_pages()
helper to share the page unpinning loop.

Reported-by: Jens Axboe <[email protected]>
Closes: https://lore.kernel.org/linux-block/[email protected]/
Cc: Liam R. Howlett <[email protected]>
Signed-off-by: Ming Lei <[email protected]>
Tested-by: Shin'ichiro Kawasaki <[email protected]>