cuse: Assert the server refcount

Assert that the refcount does not underflow before decrementing it, and
that it really is zero by the time the server is freed.

MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Reviewed by:	kib
Differential Revision:	https://reviews.freebsd.org/D60043

sys/fs/cuse/cuse.c

@@ -648,6 +648,7 @@ cuse_server_unref(struct cuse_server *pcs)
 	 */
 	cuse_global_lock();
 	cuse_server_lock(pcs);
+	MPASS(pcs->refs > 0);
 	if (--(pcs->refs) != 0) {
 		cuse_server_unlock(pcs);
 		cuse_global_unlock();
@@ -683,6 +684,7 @@ cuse_server_unref(struct cuse_server *pcs)
 
 	mtx_destroy(&pcs->mtx);
 
+	MPASS(pcs->refs == 0);
 	free(pcs, M_CUSE);
 }