When aborting command waiting in restart queue remove it from the
queue before freeing it.  This should fix NULL dereference panics
we saw on some very busy system.

MFC after:	2 weeks

(cherry picked from commit 40fb1b8bc1cf452d83edc5b25bc1d8bd13c0e72d)

 - When handling notify acknowledge from target code for task abort
request, not only send abort to the firmware, but also delete the
ATIO private data associated with the command.  It is required for
proper tag reuse, allowing new "conflicting" commands to be passed
to the target.  CTL was already fixed to handle that right, instead
of delaying them in restart queue of the driver.
 - When target finally aborts the command (which it should have
done before the notify ack) we should not send another abort to
the firmware.  Since we already sent the abort and deleted ATIO
private data above, just return successful completion here, doing
nothing.  Since the tag can be reused by that time, we can not
rely on its uniqueness, so when searching to the ATIO private data
compare also the aborted CCB pointer in addition to the tag.
 - Fix BA_RJT sending in isp_acknak_abts().  While it should be
rare, teach the code to send error responses for ABTS requests.

MFC after:	2 weeks

(cherry picked from commit ec3175fc3b2c1b07144a85e6a3e2fe534acc0c87)