Fix the leaking req on failure to put a waiting-list session back

in play in a way that does not lead to panics.

Spotted by:	Martin
Fixes		#1607

bin/varnishd/cache/cache_hash.c

@@ -533,13 +533,8 @@ hsh_rush(struct worker *wrk, struct objhead *oh)
 		AZ(req->wrk);
 		VTAILQ_REMOVE(&wl->list, req, w_list);
 		DSL(DBG_WAITINGLIST, req->vsl->wid, "off waiting list");
-		if (SES_ScheduleReq(req)) {
-			/*
-			 * We could not schedule the session, put it back.
-			 */
-			VTAILQ_INSERT_HEAD(&wl->list, req, w_list);
+		if (SES_ScheduleReq(req))
 			break;
-		}
 	}
 	if (VTAILQ_EMPTY(&wl->list)) {
 		oh->waitinglist = NULL;

bin/varnishd/cache/cache_session.c

@@ -241,6 +241,7 @@ SES_ScheduleReq(struct req *req)
 	if (Pool_Task(pp->pool, &sp->task, POOL_QUEUE_FRONT)) {
 		AN (req->vcl);
 		VCL_Rel(&req->vcl);
+		SES_ReleaseReq(req);
 		SES_Delete(sp, SC_OVERLOAD, NAN);
 		return (1);
 	}