fix panic in worklist_set_delivered

when we prune the tree, we may the current node containing the link
to the next unpending node may get freed, so we need to iterate using
the _SAFE variant which saves it.

src/node.c

@@ -878,12 +878,12 @@ static void
 worklist_set_delivered(struct req *req, struct bytes_tree *tree,
     struct node_head *work)
 {
-	struct node *node, *parent;
+	struct node *node, *parent, *tmp;
 
 	CHECK_OBJ_NOTNULL(tree, BYTES_TREE_MAGIC);
 	Lck_AssertHeld(&tree->tree_lock);
 
-	VSTAILQ_FOREACH(node, work, unpend) {
+	VSTAILQ_FOREACH_SAFE(node, work, unpend, tmp) {
 		set_delivered(tree, node);
 
 		if (VSTAILQ_NEXT(node, sibling) != NULL)