ms: store in bts->ms_list during alloc/destroy of ms object

With this change the MS no longer is removed from the llist without
potentially skipping free() if not idle in bts_ms_idle_cb().
As a result, some unit tests now can free it during bts tear down
instead of having them leaked.
The tests int MsTest need changes because the tbfs created are fake and
cannot be freed using tbf_free(), and hence cannot be detached from MS
using regular code paths. Instead first call explicit talloc_free(ms)
like other unit tests in the file already do.

Change-Id: Id53f8dfb9963366dd4b19a324615bbc83c4f23e7
diff --git a/tests/ulc/PdchUlcTest.err b/tests/ulc/PdchUlcTest.err
index a2ec373..41aa9b4 100644
--- a/tests/ulc/PdchUlcTest.err
+++ b/tests/ulc/PdchUlcTest.err
@@ -72,6 +72,8 @@
 PDCH(bts=0,trx=0,ts=0) Timeout for registered POLL (FN=34, reason=UL_ASS): TBF(DL:TFI-0-0--1:STATE-NEW:GPRS:TLLI-0x12345678)
 PDCH(bts=0,trx=0,ts=0) Expiring FN=43 but previous FN=39 is still reserved!
 PDCH(bts=0,trx=0,ts=0) Timeout for registered POLL (FN=39, reason=UL_ASS): TBF(DL:TFI-0-0--1:STATE-NEW:GPRS:TLLI-0x12345678)
+MS(TLLI-0x12345678:TA-220:MSCLS-0-0:DL) Destroying MS object
+MS(TLLI-0x12345678:TA-220:MSCLS-0-0) Detaching TBF: TBF(DL:TFI-0-0--1:STATE-NEW:GPRS:TLLI-0x12345678)
 PDCH(bts=0,trx=0,ts=0) PDCH state: disabled => enabled
 PDCH(bts=0,trx=0,ts=0) Reserving FN 104 for type SBA
 PDCH(bts=0,trx=0,ts=0) Reserving FN 117 for type SBA