Move an sftp_state check inside mutex to silence Coverity.

There's still outstanding issues in Coverity around sftp_state and
sftp_channel that need some deep thought, but this one is trivial.