fix use-after-free in inplace_stop_source::request_stop()

[eklavya072]

Fixes #1889.

When a stop callback destroys the inplace_stop_source it is registered with (which is what when_all does when its last child completes and the receiver tears down the op-state), request_stop() keeps using the freed source after the callback returns. It calls __lock_() and later stores to __state_. ASan on main:

ERROR: AddressSanitizer: heap-use-after-free
    #0 in stdexec::inplace_stop_source::request_stop() stop_token.hpp:302

Following @RobertLeahy's suggestion in the issue, ~inplace_stop_source() now handles this the same way __remove_callback_ handles callbacks:

• On the notifying thread (the source is destroyed from inside a callback), it sets a flag that lives on request_stop()'s stack, and request_stop() returns without touching *this again.
• On any other thread, it waits until request_stop() is done with the source.
• If stop was never requested, the destructor only does one atomic load, so the common case doesn't take the lock.

Tests:

• a stop callback can destroy the inplace_stop_source destroys the source from a callback while another callback is still registered.
• inplace_stop_source destructor waits for request_stop on another thread destroys it from another thread while request_stop() is still running.
• Both fail under ASan on main. The second one also catches a version that only sets the flag (TSan reports a race on it).
• The full test suite passes with the CI settings for gcc 14 Debug ASan and TSan, and clang 16 Release ASan (libc++) and Debug TSan.

The workaround from #1851 can probably be reverted once this is in, I left that for a separate PR. The same code is also in cudax's stop_token.cuh in CCCL, I can send the same change there too.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.