fix _gsm48_cc_trans_free(): send MNCC REL.ind on Clear Request

Calling gsm48_cc_tx_release() before mncc_release_ind() has a side
effect: the former may change CC state to GSM_CSTATE_RELEASE_REQ.
This makes the later send MNCC_REL_CNF instead of MNCC_REL_IND, so
if one of the call leg disconnects due to RF failure, the other one
will not be terminated correctly.

Makes both TC_{mo,mt}_call_clear_request TTCN-3 test cases pass.

Change-Id: I3ad4a99757878de3796027325627c87d9a4e93f1
Related: Id16969fe0de04445d1320a96d35cf1d48cc8cf09
Related: SYS#5340
diff --git a/tests/msc_vlr/msc_vlr_test_call.c b/tests/msc_vlr/msc_vlr_test_call.c
index b4e20be..9ab1066 100644
--- a/tests/msc_vlr/msc_vlr_test_call.c
+++ b/tests/msc_vlr/msc_vlr_test_call.c
@@ -457,11 +457,7 @@
 	fake_time_passes(15, 23);
 
 	btw("The call failed, the BSC sends a BSSMAP Clear Request");
-	/* FIXME: in this scenario, we send an MNCC_REL_CNF even though MNCC never asked us to MNCC_REL_REQ.  Legacy
-	 * behavior did get to both MNCC_REL_IND, then an MNCC_REL_REQ from MNCC as well as a final MNCC_REL_CNF, but
-	 * this only worked synchronously, i.e. only with internal MNCC. Instead of mimicking that, we need a proper
-	 * async solution that also works with a PBX. */
-	cc_to_mncc_expect_tx("", MNCC_REL_CNF);
+	cc_to_mncc_expect_tx("", MNCC_REL_IND);
 	dtap_expect_tx("032d0802e1af"); /* CC: Release */
 	expect_iu_release();
 	msc_a_release_cn(msub_msc_a(g_msub));