timer: remove race condition in 'alarm_stop()'

In 'alarm_stop()', if the ISR belonging to 'alarm_id' is executed
between the check on 'alarm->started' and the call to
'ctx->driver_disable', then the alarm is removed from the active
alarms list twice (once in the ISR 'timer_isr()' and again at the
end of 'alarm_stop()').

To avoid this scenario, these two operations have been reordered
to ensure the interrupt has been disabled before any checks are
made.

Change-Id: I5d11ddc5ed35fa87f7ff7361a518d504e285b248
Signed-off-by: Elieva Pignat <Elieva.Pignat@arm.com>