Advance list.first before freeing the chunk in cleanup_impl

[tooson9010-spec]

Summary

cleanup_impl frees a chunk with free_chunk and only then advances
list.first. free_chunk runs each element's Drop, which may unwind. When
it does, list.first still points at the chunk that was just freed, and
Drop for EventQueue walks the list from there and frees it again. A
double-free (CWE-415) reachable from safe Rust.

Two of the paths into cleanup_impl need no explicit cleanup call. With
CleanupMode::OnNewChunk (spmc default) add_chunk calls it on every chunk
boundary, so push is enough. With CleanupMode::OnChunkRead (mpmc default)
it runs when an Iter is dropped. The others are cleanup, clear and
truncate_front.

Fix

Swap the two statements so the chunk is retired before it is freed.
free_chunk reads start_position, total_capacity and free_chunk, not
list.first. Elements left in the chunk that panicked are leaked, which is
safe.

The default and double_buffering paths both go through
DynamicChunk::recycle, so one change covers them.

Verification

Added a test to src/event_queue/test.rs: 12 elements across chunks of 4, the
first panics on drop, cleanup() under catch_unwind. Without the change it
counts 13 drops for 12 elements; with it, 9.

Existing tests pass. Confirmed on 0.4.3.

[tower120]

"Project is deprecated in favor of chute." as stated in the first line of readme.
chute should provide the same functionality as rc_event_queue. If you miss something - open an issue there.