drv: check if a bo has lost all references in a 2nd pass

The same buffer can back multiple planes with different offsets. Thus
when we dereference the bo, we have to check again after all planes are
dereferenced.

This change also adds a missing unlock on an asserted return pass in
drv_bo_mapping_destroy.

BUG=b:201767377
TEST=atest android.media.cts.DecodeAccuracyTest#testGLViewDecodeAccuracy

Change-Id: I9dabf2f9b7ed33c9ed2f45b8ae498e98bfb0fc03
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/minigbm/+/3203235
Commit-Queue: Yiwei Zhang <zzyiwei@chromium.org>
Commit-Queue: Chia-I Wu <olv@google.com>
Tested-by: Yiwei Zhang <zzyiwei@chromium.org>
Auto-Submit: Yiwei Zhang <zzyiwei@chromium.org>
Reviewed-by: Chia-I Wu <olv@google.com>