mmc_rescan_cards()/mmc_delete_cards() free card ivars unconditionally after device_delete_child() — latent UAF if a child driver's detach ever fails

Summary

Both card-removal paths ignore device_delete_child's return and kfree(ivar) anyway - but DF's device_delete_child returns the detach error while leaving the child on the bus with ivars installed: the free leaves a live child pointing at freed ivars and the next pass double-frees. Latent (the only mmc child, mmcsd, cannot fail detach); any future child driver (SDIO, RPMB) returning EBUSY turns this into UAF+double-free. check-then-continue fix (the DF-5635 shape).