Call timer_remove_all with the right object.

Copy-paste bug which was introduced with rev 1.128.
Causes the parent to SIGSEGV on config reloads when mrt dumps are used.

usr.sbin/bgpd/mrt.c

···
-/*	$OpenBSD: mrt.c,v 1.133 2025/12/16 12:23:50 claudio Exp $ */
+/*	$OpenBSD: mrt.c,v 1.134 2026/02/17 14:06:44 claudio Exp $ */
 
 /*
  * Copyright (c) 2003, 2004 Claudio Jeker <[e-mail]>
···
 			    IMSG_MRT_CLOSE, 0, 0, -1, m, sizeof(struct mrt)) ==
 			    -1)
 				log_warn("mrt_reconfigure");
-			timer_remove_all(&MRT2MC(xm)->timer);
+			timer_remove_all(&MRT2MC(m)->timer);
 			LIST_REMOVE(m, entry);
 			free(m);
 			continue;
···
 
 	/* free config */
 	while ((m = LIST_FIRST(nconf)) != NULL) {
-		timer_remove_all(&MRT2MC(xm)->timer);
+		timer_remove_all(&MRT2MC(m)->timer);
 		LIST_REMOVE(m, entry);
 		free(m);
 	}