pkcs11: Avoid race condition in token hot-plug handling

If a token is removed during initialization, where `token_event_cb()` is
called manually, the callback could be triggered after the credential set
was added to the list but before it was registered with the manager.
This could then cause a use-after-free if the manager accesses it after
the other thread destroyed it.  Note that there is still a race if the
removal runs before the other thread even acquires the mutex.  We'd end
up with a registered but defunct credential set that is not backed by a
valid token.  But that shouldn't cause any crashes.

Fixes: a6d2ec331b ("Implemented a credential set on top of a PKCS#11 token")

src/libstrongswan/plugins/pkcs11/pkcs11_plugin.c

@@ -90,8 +90,8 @@ static void token_event_cb(private_pkcs11_plugin_t *this, pkcs11_library_t *p11,
 			{
 				this->mutex->lock(this->mutex);
 				this->creds->insert_last(this->creds, creds);
-				this->mutex->unlock(this->mutex);
 				lib->credmgr->add_set(lib->credmgr, &creds->set);
+				this->mutex->unlock(this->mutex);
 			}
 		}
 	}