RUSTSEC-2026-0298 Use-after-free when a future's `Drop` panics while the container is dropped

Storage::clear walks the slab, empties each entry and frees the Task allocation once its reference count reaches zero. self.tasks.setlen0 only runs after the loop. Emptying an entry drops the user future it holds, and T carries no bounds excluding a panicking Drop. If one unwinds, the length is...