fix(planner): give a re-evaluated expression its own slot in the group

[zahariash]

This work was produced with the help of language models.

Fixes #1282.

UNWIND [10, 20, NULL, 5] AS x WITH x ORDER BY x + x SKIP 0 RETURN x + x AS y crashed the process intermittently with a SIGSEGV or a glibc corrupted double-linked list abort; under ASan it is a use after free in the ORDER BY scan on the first execution.

Fix. A projection keeps out-of-scope expressions in their groups, so the ORDER BY key the WITH dropped was still registered when the RETURN's x + x, same unique name, was inserted again, and FactorizationGroup::insertExpression kept the old name-to-position entry: the final projection's result vector took the ORDER BY scan's slot, freeing the one the scan writes through. The group now maps the name to the new expression's position. The old one stays in the group's list, so its vector is still allocated, and the scan, whose positions come from the ORDER BY operator's own schema, keeps writing there. The removed DASSERT treated such a leftover as impossible; inserting a name that is still in scope remains asserted in Schema::insertToGroupAndScope.

Tests. order_by/order_by_key_repeated.test ProjectionRepeatsDiscardedOrderByKey runs the query and its x * x variant 2000 times each with -CHECK_ORDER; on main it aborts with corrupted double-linked list partway through the loop and passes here. Full suite: no failures.