Fix crash on building CANCEL requests.

Avoid the race condition between building a local cancel and handling a negative reply (for the same branch, in different processes). The build_local mya use the temporary uac->reply and end up with a dnagling pointer. Anyhow, in CANCEL situation, you never have a stored reply in transaction (storing is done only during parallel forking for nagative branches - which are not to be cancelled anyhow).

(cherry picked from commit 156fba8)

modules/tm/t_cancel.c

@@ -135,7 +135,11 @@ char *build_cancel(struct cell *Trans,unsigned int branch,
 		extra = &_extra_cancel_hdrs;
 	}
 	return build_local( Trans, branch, &method, extra,
-		Trans->uac[branch].reply , len );
+		NULL /*reply*/ , len );
+	/* ^^^^ when CANCELing, there are 0 chances to have a reply stored into
+	 * transaction ; set it NULL to avoid using the temporary stored reply 
+	 * (by t_should_relay_response) which may lead into races ( building the
+	 * cancel versus handling a final response in a different process )*/
 }