IMAP: fix use-after free in ChangeItemTask

The attribute pointer lives only as long as the owning Collection lives.
Since the code here was taking the attribute from a temporary object,
the uidNext() getter called below would return a garbage number.