A stale ELF patch plan can rewrite a newer fixed-address mapping

[CvvT]

A potential issue found by Specula:

See the full report for more details.

Trigger scenario

1. Map a read-only file-backed ELF page, creating ElfPatchState.file_mappings.
2. Replace the same address with a different read-only file using mmap(MAP_FIXED).
3. Call mprotect(addr, len, PROT_READ|PROT_EXEC).
4. maybe_patch_on_mprotect_exec collects the stale old mapping and maybe_patch_exec_segment rewrites the bytes currently at that address, which now belong to the replacement mapping.

Though benign programs should not do this, we should probably still fix it.