Double-free and use-after-free in `Keys::next()`

`Keys::next()` uses `ptr::read` to move out the `Option<V>` by value, which
drops the contained `V` when `V` is non-Copy (e.g. `String`). This leaves a
dangling value in the map's storage slot. Subsequent `get()` operations on
that key return a dangling reference to already-freed memory.

This can be triggered through safe public APIs — `Map::keys()`,
`Keys::next()`, and `Map::get()` — with no `unsafe` required from the
caller. Under Miri, accessing the freed slot produces "Undefined Behavior:
pointer not dereferenceable: alloc has been freed, so this pointer is
dangling".