mpm_event: protect deferred lingering-close chain across workers - #831

The deferred lingering-close chain has multiple worker consumers. A worker currently loads the head, then reads cs->chain for its compare-and-swap. Another worker may remove and finish closing that head in between, releasing the pool that owns cs before the first worker reads its link.

Guard insertion, removal, and the listener's scheduling snapshot with the existing timeout_mutex. A worker now detaches the head and reads its successor while holding the same lock; it processes the detached connection after releasing the lock. This keeps the link read within the node's lifetime. There is no change to the connection's close processing after dequeue.

Validation

• git diff --check passes; the branch changes only server/mpm/event/event.c.
• A targeted Apache 2.4.69 ASan/UBSan build of this fix compiled. A 32-client, two-worker deferred-close run reached five deferrals; a 256-client, 64-worker run reached 19. Neither produced a sanitizer report or child exit, and a basic GET returned HTTP 200.
• A separate test-only build held the mutex for five seconds during two deferred pops; it produced no sanitizer report. The test-only scheduling code is not included in this PR.
• The full upstream suite and a build of current trunk have not been run in this environment. A stock, unmodified server crash has not been reproduced.

• This PR does not report or address a security vulnerability.
• Code follows the httpd style guide.
• No new log messages were added.
• No user-visible change or changes entry is needed.
• A deterministic pyhttpd regression test is not included; reproducing this interleaving required a test-only scheduler pause, which is deliberately excluded from the patch.