mt76: use cancel_delayed_work_sync in mt76_rx_aggr_shutdown

The workqueue item needs to be fully shut down before the struct can be
freed.

Signed-off-by: Felix Fietkau <nbd@nbd.name>