mmal: Fix picture passing through mmal

Assign the picture pointer to mmal buffers user_data right before passing it
into mmal instead of doing it in mmal_picture_lock. This is necessary, because
the picture pointer used to call mmal_picture_lock points to the original
picture instance, while the picture handed to the plugins from
picture_pool_Get is a clone of the original picture. Assigning the picture in
user_data caused picture_Release to be called on the original instead of the
clone. Since commit 22e61f10 this is fatal as the pf_destroy pointer is not
pointing to picture_pool_ReleasePicture anymore.

Signed-off-by: Julian Scheel <julian@jusst.de>
Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>