usbcore: fix refcount bug in endpoint removal