Harden scrape rendering and add AddressSanitizer test suite

Move all heap allocation out of the slab-mutex critical section in
render_prom/render_json: snapshot cardinality under a brief lock,
allocate aggs/snaps/string tables outside the lock, then re-acquire
only to deep-copy strings and walk the LRU into the pre-allocated
buffers. A worker crash during output buffer allocation can no
longer leave the shared-memory zone locked, and a corrupt cardinality
count is caught by a 10k sanity cap rather than causing a runaway
ngx_pcalloc.

Add build-asan and tests/02-asan/: a full sanitizer-instrumented
nginx + module built via apt-source, and a 2-node containerlab
Robot suite that drives reload storms, concurrent scrape-during-reload,
and intern-table growth, failing if AddressSanitizer or UBSan
reports anything on stderr. The two Robot suites now check for
their required build artifacts up front so `make robot-test` no
longer rebuilds them on every invocation.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/02-asan/lab/client/start.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+# SPDX-License-Identifier: Apache-2.0
+# Client container entrypoint for the ASan test suite. Identical in
+# spirit to tests/01-module/lab/client/start.sh — kept as a separate
+# file so this suite's lab can be torn down and redeployed without
+# affecting 01-module state.
+
+set -e
+
+apt-get update -qq
+apt-get install -y -qq curl iproute2 > /dev/null 2>&1
+
+echo "Waiting for eth1 ..."
+while ! ip link show eth1 > /dev/null 2>&1; do
+    sleep 0.2
+done
+ip link set eth1 up
+ip addr add ${MY_IP} dev eth1
+
+# Drop the mgmt default route so data-plane traffic goes out eth1.
+ip route del default 2>/dev/null || true
+
+exec sleep infinity