frame-mt: handle frames already moved to c->out correctly after 4903d87b
Fixes assert(dst->data[0] == ((void*)0));
in dav1d_picture_ref with
clusterfuzz-testcase-minimized-dav1d_fuzzer_mt-5743306491822080. Also
fixes a memory leak of frames with
clusterfuzz-testcase-minimized-dav1d_fuzzer_mt-5655593017147392. Credits
to oss-fuzz.