io_uring/poll: fix poll_refs race with cancelation