webrtcsrc: Make sure to always call `end_session()` without the state lock
This was already done in another place for the same reason: preventing a deadlock. It's probably not correct as hinted by the FIXME comment but better than deadlocking at least.
!1695 (merged) was not complete