timer: make sure to free callback after the last timer due callback

fixes #6974

Before this change, the partial could be freed before the last due
callback got invoked, which caused a use-after-free when the due
callback called the partial.

src/nvim/eval.c

@@ -17039,7 +17039,8 @@ static void timer_stop(timer_T *timer)
   time_watcher_close(&timer->tw, timer_close_cb);
 }
 
-// invoked on next event loop tick, so queue is empty
+// This will be run on the main loop after the last timer_due_cb, so at this
+// point it is safe to free the callback.
 static void timer_close_cb(TimeWatcher *tw, void *data)
 {
   timer_T *timer = (timer_T *)data;