CVE-2026-98896: thunderbolt: Keep the domain reference while processing hotplug

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Keep the domain reference while processing hotplug

We process hotplug events in a workqueue that may run after the domain has been removed by tbdomainremove(). For example if user unloads the driver while at the same time plugging a device router we may have scheduled tbhandlehotplug() to run. Avoid possible UAF in this case by taking the domain reference before scheduling the hotplug handler in tbqueuehotplug().