perf: let Lean's allocations skip mimalloc's free-list scrub

This PR drops one store from every small allocation by telling mimalloc that Lean initializes an object's header before the object can be read, worth 0.2% to 0.3% of user instructions on elaboration.

`mi_page_malloc_zero` clears the free-list pointer in a freshly allocated block so that it cannot leak internal data to the caller. That pointer occupies the first word of the block, which for Lean is the object header, and every allocation site writes the header before anything reads it, so the store is dead. `script/mimalloc-lean.patch` puts the scrub behind `MI_BLOCK_SCRUB`, which the runtime's mimalloc variants set to 0; the guard also keeps `MI_SECURE` builds scrubbing regardless. Upstream once guarded this store with `MI_SECURE` and left the guard behind as a comment, which is what the patch reinstates under a name that states the contract.

```diff
 mov    rcx, [rax]                     ; pop the block
 mov    [rdx+0x8], rcx
 inc    WORD PTR [rdx+0x10]            ; page->used++
-mov    QWORD PTR [rax], 0x0           ; scrub the free-list pointer
 mov    WORD PTR [rax+0x4], di         ; m_cs_sz
```

Measured by swapping `libleanshared.so` between two full builds, single-threaded with `-DElab.async=false` on a pinned core with ASLR disabled: `tests/elab_bench/big_omega.lean` 18.7804G to 18.7402G user instructions (-0.214%), `import Lean` 1.93625G to 1.93010G (-0.318%).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>