an object at the same time a request-lookup does.

The functional solution to this race is to hold the objhdr mutex,
which we already hold briefly to get the refcount, also when we do
the check.

In terms of souce code this inlines the problematic HSH_FindBan()
function in the lurker.

And since that was major surgery af few other acts of improvement
was carried out also.

Most notably, we will now scan all applicable bans in the lurker
and not give up on the first ban that tests req.* variables.