RUSTSEC-2026-0282 Double free in `AlignedBox<[T]>::realloc_with_default` when an element's `Drop` panics

Shrinking an AlignedBox takes ownership of the buffer out of self.container with ManuallyDrop::take, destroys the elements past the new length, and only then commits the new Box back into self.container. ManuallyDrop::take moves ownership but not the bits, so until that commit self.container stil...