When freeing a stack frame, only poison the newly-freed memory region
`[old_top, new_top)` instead of the entire region `[limit, top)`. The old
code redundantly re-poisoned already-poisoned memory on every
`mj_freeStack` call.
Benchmarking `engine_forward_test` under ASAN:
- Before: 99.3s
- After: 75.6s (~24% faster)
PiperOrigin-RevId: 885035750
Change-Id: Ib195661ca337d13c5ff6094bcc107c4c0a617b9b
Kyle Bayes