callout_stop => callout_halt

[Ryota Ozaki <ozaki-r%netbsd.org@localhost>]

Hi,

In order to call callout_destroy for a callout
safely, we have to ensure no instance of the callout
is running. To do so, we should use callout_halt not
callout_stop, IIUC. However, there are several
callout_stop(); callout_destroy() sequences.
Should we replace such callout_stop with callout_halt?
Any suggestions?

This topic was raised when discussing PR/47881
with martin@.

Thanks,
  ozaki-r