fix: usr: prevent rare named crash when notifies are cancelled

Under heavy load, named could occasionally crash when a queued
outbound notify or zone refresh was cancelled at the moment it
was being sent — for example, while a zone was being reloaded or
removed.  The race that caused the crash is now prevented.

Closes #5915

Merge branch '5915-ratelimiter-dequeue-tick-uaf' into 'main'

See merge request isc-projects/bind9!11918