net.c: Fix use-after-free in coap_cancel()

When a subscription is canceled, coap_cancel() iterates through the
resources and deletes the observer. In addition, all outstanding
messages for this observer are removed from the send queue.

With commit 5b1a8f67, the session object associated with the deleted
observer may be automatically released by coap_delete_observer().
Therefore, coap_cancel_all_messages() must be invoked on the session
before deletion.

Fixes CID 1484386 found by Coverity scan.

src/net.c

@@ -1802,8 +1802,8 @@ coap_cancel(coap_context_t *context, const coap_queue_t *sent) {
   COAP_SET_STR(&token, sent->pdu->token_length, sent->pdu->token);
 
   RESOURCES_ITER(context->resources, r) {
-    num_cancelled += coap_delete_observer(r, sent->session, &token);
     coap_cancel_all_messages(context, sent->session, token.s, token.length);
+    num_cancelled += coap_delete_observer(r, sent->session, &token);
   }
 
   return num_cancelled;