Make sure catz->catzs isn't destroyed before catz

Call dns_catz_unref_catzs() only after detaching 'catz'.

This fixes an issue (see a failed job example) introduced during the current release cycle, so No CHANGES.

v9.18 is currently not affected, but it will become affected once the series of catz refactoring and offloading MRs are backported.