tp: extract IncrementalState to fix CustomState UAF (#5593)

Fixes the use-after-free flagged in
`PacketSequenceStateGeneration::CustomState`.

## The bug

Previously, each `CustomState` held a raw `generation_` back-pointer
that was re-pointed every time a new generation was created via
`OnNewTracePacketDefaults` (the `set_generation(this)` loop in the
multi-arg ctor). The `TraceSorter` can hold a `RefPtr` to an older
Generation `G1` while a newer `G2` — to which `G1`'s shared CustomState
had been re-pointed — is dropped after `SEQ_INCREMENTAL_STATE_CLEARED`.
`G1` stays alive (and so does the CustomState), but its `generation_`
then dangles to freed memory; any subsequent lookup through the
CustomState dereferences the freed `G2`.

## The fix

Refactor the generation/CustomState relationship so that lifetime is
correct **by construction**:

- New `IncrementalState : RefCounted`. Owns the
per-incremental-state-interval data: `interned_data_`, the array of
`CustomState`s (now `unique_ptr` rather than `RefPtr`), and the
persistent thread descriptor. A new `IncrementalState` is constructed
only on `SEQ_INCREMENTAL_STATE_CLEARED`.

- `PacketSequenceStateGeneration` becomes a thin
per-`trace_packet_defaults` snapshot: holds `RefPtr<IncrementalState>`
(shared with sibling generations within the same interval), the defaults
blob, and the validity flag. All interned-data / custom-state /
thread-descriptor accessors are forwarders to the `IncrementalState`.

- `CustomState` is no longer `RefCounted` (it's owned uniquely by its
`IncrementalState`). Its back-pointer is `IncrementalState*` and is set
exactly once at lazy-allocation time inside
`IncrementalState::GetCustomState<T>`. Because the `IncrementalState`
owns the `CustomState`, the pointer is stable for the entire life of the
CustomState — UAF impossible.

- `OnNewTracePacketDefaults` no longer copies the `InternedFieldMap` or
re-points CustomStates; it constructs a new Generation that shares the
same `RefPtr<IncrementalState>`. This removes a per-defaults-change copy
that could be O(map-size) in the hot path.

- `OnPacketLoss` walks the IncrementalState's CustomState array and
clears any slot whose `ClearOnPacketLoss()` opted in (TES today), then
returns a new Generation referencing the same `IncrementalState` with
the validity bit cleared.

---

**Stack:**
- #5588 — tp: stop mutating PacketSequenceStateGeneration on packet loss
- #5590 — tp: split TrackEventSequenceState into descriptor + delta
state
- **#5593 — tp: extract IncrementalState to fix CustomState UAF** (this
PR)