[iobuf] Add iob_disown() and use it where it simplifies code

There are many functions that take ownership of the I/O buffer they
are passed as a parameter.  The caller should not retain a pointer to
the I/O buffer.  Use iob_disown() to automatically nullify the
caller's pointer, e.g.:

    xfer_deliver_iob ( xfer, iob_disown ( iobuf ) );

This will ensure that iobuf is set to NULL for any code after the call
to xfer_deliver_iob().

iob_disown() is currently used only in places where it simplifies the
code, by avoiding an extra line explicitly setting the I/O buffer
pointer to NULL.  It should ideally be used with each call to any
function that takes ownership of an I/O buffer.  (The SSA
optimisations will ensure that use of iob_disown() gets optimised away
in cases where the caller makes no further use of the I/O buffer
pointer anyway.)

If gcc ever introduces an __attribute__((free)), indicating that use
of a function argument after a function call should generate a
warning, then we should use this to identify all applicable function
call sites, and add iob_disown() as necessary.

src/arch/i386/drivers/net/undinet.c

@@ -482,8 +482,7 @@ static void undinet_poll ( struct net_device *netdev ) {
 					 undi_isr.Frame.offset, frag_len );
 			if ( iob_len ( iobuf ) == len ) {
 				/* Whole packet received; deliver it */
-				netdev_rx ( netdev, iobuf );
-				iobuf = NULL;
+				netdev_rx ( netdev, iob_disown ( iobuf ) );
 				/* Etherboot 5.4 fails to return all packets
 				 * under mild load; pretend it retriggered.
 				 */