arm64: Detect branches into the relocated range

Interceptor rewrites relocated CBZ/TBZ/B as absolute jumps back to the
original target. When that target lands inside the bytes about to be
overwritten, the rewritten branch jumps into the middle of the redirect
patch and faults with SIGILL.

dispatch_mach_msg_get_msg() is a concrete case: a leading "CBZ x1, +12"
lives inside the first 16 bytes that a full redirect would claim. With
x1 == NULL the rewritten CBZ resumes at function+12, which is no longer
code.

The CHECKED policy only scanned control flow after the relocated range,
so it never saw branches originating inside it. Scan the already-read
instructions for such targets, shrink n so they fall outside the patch,
and rewind input_cur/input_pc before the existing reachability walk.

This makes can_relocate(16) fail for that prologue and forces an 8-byte
near redirect instead.

submodules: Bump releng

submodules: Bump releng

submodules: Bump releng

submodules: Bump releng

gumjs: Commit NO_ACCESS pages in Memory.alloc

Memory.alloc(size, { protection: '---' }) went through gum_memory_
allocate(), which only reserves NO_ACCESS pages on Windows, so a
later Memory.protect() to a usable protection failed. Recommit them,
as gum_alloc_n_pages() used to.

darwin: Re-enable CodeSegment on newer kernels

The vm_remap OVERWRITE trick that ef6f67b disabled for kernels
>= 8020.142.0 (iOS >= 15.6.1) works again on iOS >= 17.6, so let
gum_code_segment_is_supported() return TRUE for xnu >= 10063.142.1.

module-registry: Fix overlong line

darwin: Populate registry before interceptor

The first gum_interceptor_obtain() activates the unwind
broker, whose backend resolves libdyld through the module
registry. Obtaining it before the snapshot re-entered an
empty registry, crashing on a NULL module lookup.

Snapshot the modules first, then start change tracking.

linux: Find musl RTLD call sites on disk

Scanning live memory missed call sites a second GumModuleRegistry
had already redirected, so it fell back to clobbering the tiny
stub. Read the linker's on-disk image instead: the original
instructions always survive there, and hooking the same loaded
addresses lets the interceptors chain.