scsi: target: Clear cmd_cnt when initial counter enrollment fails

When target_get_sess_cmd() fails during session shutdown because
percpu_ref_tryget_live() returns false, the command keeps the
se_cmd->cmd_cnt pointer that __target_init_cmd() assigned earlier without
owning a reference. Final release through target_release_cmd_kref() then
issues an unmatched percpu_ref_put().

Commit 8e288be8606a ("scsi: target: Pass in cmd counter to use during cmd
setup") moved the cmd_cnt assignment ahead of the reference acquisition.
Clear se_cmd->cmd_cnt whenever the initial target_get_sess_cmd() fails in
target_init_cmd() and target_submit_tmr(), so release performs exactly one
matching put per acquired reference.

Fixes: 8e288be8606a ("scsi: target: Pass in cmd counter to use during cmd setup")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>