cm: Fix KCB pushlock leaks in CmpLookInCache and CmpDoOpen

[Copilot]

SMP stress testing revealed regular deadlocks where KCB pushlocks had permanent waiters with no active holder — leaked lock acquisitions that block all subsequent acquirers indefinitely.

Bug 1 — CmpLookInCache: lock leak on reference failure

When a key is found in the cache and CmpReferenceKeyControlBlock(CurrentKcb) fails, the function returned STATUS_UNSUCCESSFUL without releasing the locks acquired by CmpBuildAndLockKcbArray. Those pushlock slots leaked permanently.

The fix also corrects a secondary ordering issue: the old code dereferenced *Kcb and assigned *Kcb = CurrentKcb before the reference attempt, leaving the caller's pointer in an inconsistent state on failure.

/* Before: deref old, assign, then try to reference — leak on failure */
CmpDereferenceKeyControlBlock(*Kcb);
*Kcb = CurrentKcb;
if (!CmpReferenceKeyControlBlock(*Kcb))
    return STATUS_UNSUCCESSFUL;  // LockedKcbs never released

/* After: reference first, clean up on failure, then swap */
if (!CmpReferenceKeyControlBlock(CurrentKcb))
{
    CmpUnLockKcbArray(LockedKcbs);
    CmpDereferenceKeyControlBlock(*Kcb);
    return STATUS_UNSUCCESSFUL;
}
CmpDereferenceKeyControlBlock(*Kcb);
*Kcb = CurrentKcb;

Bug 2 — CmpDoOpen: stale IsLockShared in symlink-found path

In CmpDoOpen with CMP_OPEN_KCB_NO_CREATE, when CM_KCB_SYM_LINK_FOUND is set and the real KCB is live, the code upgrades from shared to exclusive lock but left IsLockShared = TRUE. This flag is later passed to EnlistKeyBodyWithKCB as CMP_ENLIST_KCB_LOCKED_SHARED. When the KeyBodyArray is full, that function calls CmpReleaseKcbLock(KeyBody->KeyControlBlock) — releasing a lock on RealKcb that was never acquired, and then re-acquiring exclusive on an index already held exclusively.

Fix: add IsLockShared = FALSE after the exclusive re-lock.