`ShMem` should not give out references, pt. 2

You can recreate #1748 with [the `impl DerefMut` for `MmapShMem`](https://docs.rs/libafl_bolts/0.14.1/libafl_bolts/shmem/unix_shmem/struct.MmapShMem.html#impl-DerefMut-for-MmapShMem).
```rust
// cargo init
// cargo add --no-default-features --features=std --git https://github.com/AFLplusplus/LibAFL libafl_bolts
// cargo run

use std::ops::{DerefMut as _};
use libafl_bolts::shmem::{ShMemProvider as _};

pub fn main() {
let mut prov = libafl_bolts::shmem::MmapShMemProvider::default();
let mut shmem1 = unsafe { prov.new_on_shmem::(0).unwrap_unchecked() };
let mut shmem2 = unsafe { prov.clone_ref(&shmem1).unwrap_unchecked() };
let r1 = &mut shmem1.deref_mut()[0];
let r2 = &mut shmem2.deref_mut()[0];
go(r1, r2);
}

pub fn go(r1: &mut u8, r2: &mut u8) {
mut_r1(r1);
mut_r2(r2);
if *r1 == 1 {
println!("r1 = {r1}");
}
}

pub fn mut_r1(r1: &mut u8) {
*r1 = 1;
}

pub fn mut_r2(r2: &mut u8) {
*r2 = 32;
}
```
Prints
```
r1 = 32
```

Start with the MmapShMem DerefMut implementation linked in the issue and trace how clone_ref produces the second handle. Run the provided reproducer to confirm the aliasing behavior. Done means shared-memory handles no longer expose independently mutable references to the same bytes, with coverage for this case.

索引モデルが issue の本文から書いたものです。