Fix use-after-free in moveForSlabRelease fragmentation stats

Summary:
`moveForSlabRelease` called `util::getFragmentation(*this, oldItem)` after
`allocator_->free(&oldItem)`, accessing freed memory (`getSize()`,
`isChainedItem()`, `getKey()`). Move the fragmentation computation before the
`free()` call to eliminate the use-after-free.

Reviewed By: rlyerly

Differential Revision: D98666914

fbshipit-source-id: 427d5a8e460d22a3d13e4941401d7dd8b60bd3a9

Author: AlnisM

cachelib/allocator/CacheAllocator.h

@@ -5246,10 +5246,9 @@ bool CacheAllocator<CacheTrait>::moveForSlabRelease(Item& oldItem) {
     auto ref = unmarkMovingAndWakeUpWaiters(oldItem, std::move(newItemHdl));
     XDCHECK_EQ(0u, ref);
   }
-  allocator_->free(&oldItem);
-
   (*stats_.fragmentationSize)[allocInfo.poolId][allocInfo.classId].sub(
       util::getFragmentation(*this, oldItem));
+  allocator_->free(&oldItem);
   stats_.numMoveSuccesses.inc();
   return true;
 }