Fix a race when switching rooms at different accounts

That atomic pointer to Connection in ThumbnailProvider was never enough
to protect against the old connection being used with the new current
room, or vice versa because of a too early, or too late, request for
an avatar from QML around the moment of switching to the new room.

This commit introduces an interim null room state in
MessageEventMode::changeRoom() - this way, the old QML objects have no
chance to issue requests over the connection that already got updated;
and new QML objects only come to exist when the connection is set to
the new value.

client/models/messageeventmodel.cpp

@@ -72,6 +72,8 @@ MessageEventModel::MessageEventModel(QObject* parent)
     // connection to modelReset. Ideally the room property could use modelReset
     // for its NOTIFY signal - unfortunately, moc doesn't support using
     // parent's signals with parameters in NOTIFY
+    // NB: this makes all roomChanged connections order before modelReset
+    // connections
     connect(this, &MessageEventModel::modelReset, //
             this, &MessageEventModel::roomChanged);
 }
@@ -83,13 +85,18 @@ void MessageEventModel::changeRoom(QuaternionRoom* room)
     if (room == m_currentRoom)
         return;
 
-    if (m_currentRoom)
+    if (m_currentRoom) {
         qCDebug(EVENTMODEL)
             << "Disconnecting event model from" << m_currentRoom->objectName();
-    beginResetModel();
-    if (m_currentRoom)
+        // Reset the model to a null room first to make sure QML dismantles
+        // last room's objects before the room is actually changed
+        beginResetModel();
         m_currentRoom->disconnect(this);
+        m_currentRoom = nullptr;
+        endResetModel();
+    }
 
+    beginResetModel();
     m_currentRoom = room;
     if (m_currentRoom) {
         using namespace Quotient;