Double free in `Map::into_iter` and an uninitialized `Arc` in `SharedIncin::clear`

Two independent soundness problems, both reachable from safe Rust.

`Map::into_iter` drops `builder` (the caller-supplied hasher `H`) and `incin` by
hand, then commits the ownership transfer with `mem::forget(self)`. `H::drop` is
user code and may panic. If it does, `mem::forget(self)` is skipped and the
still-live `Map` unwinds, whose field drop glue destroys `builder` a second
time. An empty map is enough — no entries or concurrency required.

`SharedIncin::clear` writes `mem::uninitialized::<Arc<_>>()` into `self.inner`
before taking the real `Arc` out. `Arc` has a validity invariant, so this is
undefined behaviour at the point of creation, with no panic or concurrency
involved. Between that write and the repairing one, `self.inner` also holds
garbage while `self` is still droppable, so an unwind from `incin.clear()` or
`Arc::new` decrements a refcount through an uninitialized pointer. The
`make_shared_incin!` macro is instantiated five times, so this covers `queue`,
`stack`, `map`, `channel::spmc` and `channel::mpmc`.

## Impact

* CWE-415 (Double Free): the same allocation is freed twice.
* CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated `Drop`.
* CWE-908 (Use of Uninitialized Resource): an `Arc` is constructed from uninitialized bytes.

## Fix

No fixed release is available. The crate has had no release since 2018-11-18 and
the maintainer has not responded to the report.