[retry] Hold reference while timer is running and during expiry callback

[retry] Hold reference while timer is running and during expiry callback

Guarantee that a retry timer cannot go out of scope while the timer is
running, and provide a guarantee to the expiry callback that the timer
will remain in scope during the entire callback (similar to the
guarantee provided to interface methods).

Signed-off-by: Michael Brown <mcb30@ipxe.org>