fix(usb): a scan whose command failed is forgotten, so a late answer cannot finish a freed request

rwnx_cfg80211_scan() stores the request in rwnx_hw->scan_request before sending SCANU_START_REQ. When the send
fails, the error goes back to cfg80211, which frees the request, but scan_request still points at it. A late
SCANU_START_CFM (or the next scan's completion) then calls cfg80211_scan_done() on freed memory.

Seen on an AIC8800DC with a command timeout injected during a scan: the kernel panicked in cfg80211_scan_done(),
caught twice on the serial console.

drivers/aic8800/aic8800_fdrv/rwnx_main.c

@@ -2947,8 +2947,10 @@ static int rwnx_cfg80211_scan(struct wiphy *wiphy,
 	}
 
     rwnx_hw->scan_request = request;
-    if ((error = rwnx_send_scanu_req(rwnx_hw, rwnx_vif, request)))
+    if ((error = rwnx_send_scanu_req(rwnx_hw, rwnx_vif, request))) {
+        rwnx_hw->scan_request = NULL;
         return error;
+    }
 
     return 0;
 }