soup-message-io: keep cancellable alive for duration of io_run_until

soup-message-io: keep cancellable alive for duration of io_run_until

io_run() passes io->cancellable to io_run_until(), but io may be
destroyed (and cancellable unreffed) before io_run_until() returns,
causing it to eventually call g_cancellable_is_cancelled() on garbage.
Fix by reffing it around the io_run_until() call (though really this
is just another example of "SoupMessageIOData needs to be
refcounted".)

Tweak misc-test to test this case.

Fixes crasher in rygel test case. Based on a patch from Ray Strode.
https://bugzilla.gnome.org/show_bug.cgi?id=676038