rtpbin2: fix ABBA deadlock in rtcp recv reply handling

Everywhere we are first locking the state, then the session, but here we were locking the state, cloning the session from it, locking the session, releasing the state then trying to lock it again, giving the opportunity for someone to lock the state then deadlock on trying to lock the session on their end.

Fix by simply cloning the sink pad and dropping the session before processing the replies.