Randomize the layout of zend_mm small freelists

[jvoisin]

zend_mm_alloc_small_slow() carved a fresh bin into a freelist ordered by ascending address and returned the first element, so the address of every small allocation was entirely determined by the allocation sequence: the n-th allocation of a given size class always landed at bin + n*slot_size, and two consecutive allocations were always adjacent.

That determinism is what makes heap feng-shui reliable. An attacker who can drive a few allocations of the right size class knows exactly where the next one lands, and can therefore place a victim object immediately after a buffer he can overflow, or reclaim a specific freed slot with an object of a chosen type.

Shuffle the slot order when a bin is created: hand out the first slot of the shuffled sequence and link the remaining ones in that order. This is the ~equivalent of Linux' SLAB_FREELIST_RANDOM.

Performance-wise, it:

• Adds two scratch arrays of ZEND_MM_MAX_BIN_ELEMENTS entries (4KiB total) live on the stack of a non-recursive slow path.
• Adds a per-bin-creation shuffleing, on the slow path.
• Reduces spatial locality of allocations, but Zend/bench.php shows no measurable difference.

Can be compiled out with -DZEND_MM_FREELIST_RANDOM=0.

[jvoisin]

Part of #14083