bridge: fix use-after-free in br_cleanup_bridges()