kernel/user.c: add lock release annotation on free_user()