User mapping state not serialized across concurrent ring map/unmap IOCTLs (kernel bugcheck 0x50)

The `ebpf_ring_map_user` / `ebpf_ring_unmap_user` pair in [`libs/runtime/kernel/ebpf_platform_kernel.c`](https://github.com/microsoft/ebpf-for-windows/blob/main/libs/runtime/kernel/ebpf_platform_kernel.c) uses plain loads/stores to check and set `user_consumer_address`, `user_producer_address`, and `user_process` — no synchronization. The WDF parallel dispatch queue (`ebpfcore/ebpf_drv.c:244-247, 325-328`) can deliver map and unmap IOCTLs concurrently.

Two threads can race in `ebpf_ring_map_user` at line 233: both see `user_consumer_address == NULL`, both call `MmMapLockedPagesSpecifyCache`, both store their result — last writer wins and the first mapping's addresses and process reference are silently lost. Conversely, a concurrent map+unmap pair can produce a torn `user_process` read during cleanup (`ObDereferenceObject(NULL)` → kernel bugcheck 0x50). A 3-state CAS prototype triggered exactly this bugcheck in stress testing before the 4-state version was deployed.

The trigger requires concurrent map/unmap IOCTLs on the same ring from a single process (or two processes sharing the map) — an unusual API pattern. Severity is `critical*` (kernel-crash class with uncommon-trigger asterisk).

Discovered locally during code review of `ebpf_platform_kernel.c` ring-map paths. Fix in flight as OPEN PR #5308 on fork branch [`mikeagun:fix/user-mapping-safety`](https://github.com/mikeagun/ebpf-for-windows/tree/fix/user-mapping-safety) (substantive commits `b4cf4c700` synchronizing map/unmap state, and `048422994` adding an unmapping-in-progress state).