[roll] Roll fuchsia [driver_runtime] Fix UAF race between handle deletion and lookup

In HandleTableArena::Delete, the handle is reset before acquiring
the arena's lock. This can race with MapValueToHandle and GetObject
on other threads, leading to a Use-After-Free of the underlying
runtime object if it is destroyed while another thread is trying
to copy its RefPtr.

This fix:
1. Moves \`handle->Reset()\` inside the lock in \`Delete\`.
2. Implements \`HandleTableArena::GetObject\` and \`TakeOwnership\`
   which perform lookup and object retrieval/reset under the arena lock.
3. Updates \`Handle::GetObject\` (static) and \`fdf_handle_close\` to
   use these new safe methods.
4. Moves \`Handle::GetObject\` (static) template implementation to the
   bottom of \`handle.h\` to resolve circular dependency with
   \`gHandleTableArena\`.
5. Updates \`HandleTableArena::Alloc\` to perform placement new under
   lock, ensuring the handle is fully initialized before it is returned.
6. Fixes compilation of \`dispatcher_death_test.cc\` by including
   \`dispatcher_coordinator.h\`.

Original-Original-Bug: 519271685
Test: driver_runtime_tests, driver_runtime_scheduler_role_tests,
      driver_runtime_death_tests, driver_runtime_dispatcher_death_tests,
      driver_runtime_shutdown_process_tests, driver_runtime_sdk_tests

Original-Original-Reviewed-on: https://fuchsia-review.googlesource.com/c/fuchsia/+/1677234
Original-Original-Revision: dfd4435f4745aa3e21f0c6eeb21ec3ac56490694
GitOrigin-RevId: a7ad2bbd3df6ae618405185b88517cdafa00e33a
Change-Id: I5fceab766c54ffd564fba3e0406756cf58d5bfc7
Reviewed-on: https://fuchsia-review.googlesource.com/c/integration/+/1681157
Cr-Commit-Position: refs/heads/main@{#195593}