Increment slab slot tags deterministically on reuse

[jvoisin]

Previously every reuse of a slab slot picked a fresh random MTE tag, excluding the reserved, previous and neighbor tags. MTE tags are 4 bits with tag 0 reserved, leaving 15 usable tags, so a stale pointer to tag t evaded use-after-free detection whenever a reallocation happened to draw t again.

With the random scheme the previous tag is excluded, so the first reuse is always detected, but every reuse from the second onward independently draws t with probability 1/(15 - n), where n is the number of usable tags excluded that cycle (previous tag plus neighbors, n in 1..3), i.e. ~7% (1/14) to ~8% (1/12) per cycle. That risk compounds: the chance of evasion within N reuses is ~1 - (13/14)^(N-1), already ~49% by 10 reuses.

Keep a random tag for the first use of a slot, but on every subsequent reuse derive the next tag by incrementing the stored previous tag, skipping excluded values. The tag advances monotonically around the ring and only coincides with the stale tag t once per lap, so detection is deterministic across a full lap of the usable tags instead of leaking ~7% per cycle. A lap is up to 14 reuse cycles; because the two neighbor tags are also excluded each cycle, the increment can skip past them and complete a lap in fewer steps, so 14 is an upper bound rather than a guaranteed floor. Neighbor tags remain excluded, so deterministic linear-overflow detection is unchanged.

This trades the random scheme's per-allocation unpredictability for deterministic multi-cycle detection: a slot's tag sequence is now fully determined by its previous and neighbor tags, so leaking one tag reveals the slot's tag for every other cycle. Slot selection remains randomized, and this matches the deterministic tagging already used for linear overflows.

Note that since my laptop doesn't have MTE, this commit couldn't be tested on MTE hardware.