Fix queue crashes that would occur after the calling channel was masqueraded.

Fix queue crashes that would occur after the calling channel was masqueraded.

The data passed to the end_bridge_callback was assumed to be data which was
still stack'd. The problem was that with some call features, attended transfers
in particular, a new bridge thread is started once the feature completes, meaning
that when the end_bridge_callback is called, the end_bridge_callback_data was
invalid.

To fix this problem, there are two measures taken

1. Instead of pointing to stacked data, we now used heap-allocated data for
passing to the end_bridge_callback in app_queue
2. Since bridges can end multiple times on a single logical call, we wait until
the final bridge is broken to actually set any queue variables. This is accomplished
through reference-counting and the use of an end_bridge_callback_data_fixup function
in app_queue.c

(closes issue #14260)
Reported by: ccesario
Patches:
      14260.patch uploaded by putnopvut (license 60)
Tested by: ccesario

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@171618 65c4cc65-6c06-0410-ace0-fbb531ad65f3