[committed on behalf of sephe]

[committed on behalf of sephe]

- Fix ieee80211_node leakage.  The leakage is caused by calling IF_DRAIN()
  on management ifqueue whose mbuf's m_pkthdr.rcvif has special meaning:
  it holds ieee80211_node to which the management frame should be sent and
  the node has its reference count bumped.
  Add a new function ieee80211_drain_mgtq(), which frees ieee80211_node
  pointed by mbuf's m_pkthdr.rcvif before freeing the mbuf.  Use this function
  to drain management ifqueue instead of IF_DRAIN().
- In acx(4), ipw(4), ral(4) and rum(4) 'stop' routines, move
  ieee80211_new_state(IEEE80211_S_INIT) before clearing IFF_RUNNING in
  ifnet.if_flags, so these drivers may send out management frames injected
  by ieee80211_newstate(IEEE80211_S_INIT). (*)

# (*) Without proper hardware TX queue drain functionality, the management
#     frames injected by ieee80211_newstate(IEEE80211_S_INIT) almost no
#     chance to float in the air.