serial: caif: hold tty->link reference in ldisc_open and ser_release

In the Linux kernel, the following vulnerability has been resolved:

serial: caif: hold tty->link reference in ldisc_open and ser_release

A reproducer triggers a KASAN slab-use-after-free in pty_write_room()

when caif_serial's TX path calls tty_write_room(). The faulting access

is on tty->link->port.

Hold an extra kref on tty->link for the lifetime of the caif_serial line

discipline: get it in ldisc_open() and drop it in ser_release(), and

also drop it on the ldisc_open() error path.

With this change applied, the reproducer no longer triggers the UAF in

my testing.