Mutex::unlock - decrement _count inside lock

`Mutex::unlock` was decrementing the `_count` member after releasing
the mutex, which meant it was unprotected, exposing a race that
could corrupt the count.

This could lead to an assert in `ConditionVariable::wait`, which
checks that the mutex count is one.

rtos/source/Mutex.cpp

@@ -123,10 +123,12 @@ bool Mutex::trylock_until(Kernel::Clock::time_point abs_time)
 
 void Mutex::unlock()
 {
-    osStatus status = osMutexRelease(_id);
-    if (osOK == status) {
+    // Count must be adjusted inside the lock. This would leave it incorrect
+    // on failure, but it only is used for an assert in ConditionVariable,
+    // and a mutex release failure means MBED_ERROR anyway.
     _count--;
-    }
+
+    osStatus status = osMutexRelease(_id);
 
     if (status != osOK && !mbed_get_error_in_progress()) {
         MBED_ERROR1(MBED_MAKE_ERROR(MBED_MODULE_KERNEL, MBED_ERROR_CODE_MUTEX_UNLOCK_FAILED), "Mutex unlock failed", status);