resolve: anchor the service browser from mDNS maintenance queries

resolve: anchor the service browser from mDNS maintenance queries

mdns_maintenance_query() takes a ref on the browser's varlink link but
never installs itself as that link's userdata. dns_query_free() then
unconditionally runs sd_varlink_set_userdata(varlink_request, NULL),
so freeing any maintenance query wipes the browse query's registration
on the shared sb->link slot, disabling the abort paths in
vl_on_disconnect() and dns_service_browser_free(). The maintenance
query also never takes a reference on the DnsServiceBrowser, so a client
disconnect could free the browser while a maintenance query was still
in flight, leaving the per-service schedule_event timer and the raw
service->service_browser back-pointer dangling (use-after-free on the
next timer tick or query completion).

Take a service_browser_request reference instead, matching the browse
query path. dns_query_free() already drops it. The browser now outlives
its in-flight maintenance queries.

Follow-up for 8458b7fb91ea5e5109b6f3c94f8a781a120c798b