heap: Fix inconsistencies in HeapObserverList

The observer list is both weak (implicitly managed) and allows for
removing observers. If observers are removed while at the same time
multiple other observers die, and the removal call triggers GC, this may
lead to CHECK() failures where the index retrieved on `RemoveObserver`
is too large for the `observers_` array.

Bug: 438569732, 438916130
Change-Id: I6731ad38e96f01a47258bc8f8f5a0b1b41e736a3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6859882
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1503316}