Fix inconsistent synchronization of PoolSubpage.doNotDestroy (#12775)

Motivation:
This field is modified under lock, and thus should not be accessed (toString excepted) without locking.

Modification:
Move an assert check on PoolSubpage.doNotDestroy into a nearby critical region.

Also encapsulate the findSubpagePoolHead logic better; PoolArena now always use this method instead of that one place that was accessing the array directly. This should not have any influence on the logic.

Result:
Assert in PoolChunk is no longer racy.

buffer/src/main/java/io/netty5/buffer/api/pool/PoolChunk.java

@@ -460,12 +460,12 @@ void free(long handle, int normCapacity) {
 
             int sIdx = runOffset(handle);
             PoolSubpage subpage = subpages[sIdx];
-            assert subpage != null && subpage.doNotDestroy;
 
             // Obtain the head of the PoolSubPage pool that is owned by the PoolArena and synchronize on it.
             // This is need as we may add it back and so alter the linked-list structure.
             head.lock();
             try {
+                assert subpage != null && subpage.doNotDestroy;
                 if (subpage.free(head, bitmapIdx(handle))) {
                     //the subpage is still used, do not free it
                     return;