The implementation of `InPlaceIterable` for `Flatten`&`FlatMap` is unsound

const S: String = String::new();
fn main() {
    let v = vec![[S, "Hello World!".into()], [S, S]];
    let mut i = v.into_iter().flatten();
    let _ = i.next();
    let result: Vec<String> = i.clone().collect();
    println!("{result:?}");
}

(playground)

["\0\0\0\0\0\0\0\0rld!", "\0\0\0\0\0\0\0\0rld!", ""]
free(): invalid pointer
[1]    1131073 IOT instruction (core dumped)

The above code is analogous to #85322 but applied to Flatten instead of Peekable: cloning the whole iterator doesn't preserve capacity in the inner vec::IntoIter. (This also applies to FlatMap.)

Introduced in 1.76

cc @the8472, #110353

@rustbot label T-libs, I-unsound, A-iterators

Start by running the provided reproducer on nightly and compare the behavior with issue #85322. Trace the InPlaceIterable implementations for Flatten and FlatMap, along with the inner vec::IntoIter clone behavior. Done means cloning after partial iteration no longer produces corrupted strings or an invalid-pointer crash, with coverage for the reported case.