clockintr: add clockintr_cancel_locked()

clockintr: add clockintr_cancel_locked()

Move the CLST_PENDING check and TAILQ_REMOVE() in
clockintr_schedule_locked() into a dedicated function,
clockintr_cancel_locked().  clockintr_schedule_locked() no longer
implicitly cancels a pending clockintr: it is the caller's
responsibility to check for CLST_PENDING and cancel any pending
expiration before calling clockintr_schedule_locked().  We can skip
the CLST_PENDING check during the dispatch loop because we know for
certain the clockintr in question is pending.

This is more verbose but I think it is less surprising.  Both
functions do one thing.