Histogram shmem invalid-free POC

This page is loaded by a "compromised renderer" build (see chromium-changes.patch). The injected renderer code, simulating an attacker with renderer code execution, writes two forged PersistentHistogramData records into the writable UMA shared-memory region:

1. Record 1: a valid HISTOGRAM named "dummy_histogram" (min=1, max=100, 50 buckets). When the browser merges this it heap-allocates and registers a Histogram at HashMetricName("dummy_histogram") in its StatisticsRecorder.
2. Record 2: a HISTOGRAM named "evil2" with bucket_count=2 and ranges [0,5,100], giving declared_min == declared_max == 5. DeserializeHistogramInfo → FactoryGetInternal("evil2",5,5,2) hits kBucketsInvalidMinMaxSame and returns the static NoDestructor<DummyHistogram> singleton, which RegisterOrDeleteDuplicate then deletes because Record 1 already occupies its hash slot.

The renderer terminates immediately after forging the records, which triggers SubprocessMetricsProvider::DeregisterSubprocessAllocator → MergeHistogramDeltasFromAllocator in the browser process.

Expected: ASAN attempting free on address which was not malloc()-ed in the browser process, inside StatisticsRecorder::RegisterOrDeleteDuplicate.