[WebGPU] Buffer instance can transition from Destroyed -> Unmapped state

https://bugs.webkit.org/show_bug.cgi?id=274446
<radar://128396385>

Reviewed by Dan Glastonbury.

Once destroyed, a Buffer is not allowed to be used in any
operations and should remain in the destroyed state.

* LayoutTests/TestExpectations:
* LayoutTests/fast/webgpu/fuzz-128396311-expected.txt: Added.
* LayoutTests/fast/webgpu/fuzz-128396311.html: Added.
Add regression test.

* Source/WebGPU/WebGPU/Buffer.h:
* Source/WebGPU/WebGPU/Buffer.mm:
(WebGPU::Buffer::destroy):
(WebGPU::Buffer::mapAsync):
(WebGPU::Buffer::setState):
(WebGPU::Buffer::unmap):

Canonical link: https://commits.webkit.org/279083@main

LayoutTests/TestExpectations

@@ -2141,6 +2141,8 @@ webkit.org/b/139639 [ Debug ] cssom/non-subpixel-scroll-top-left-values.html [ S
 [ Release ] fast/webgpu/fuzz-274171.html [ Pass Failure Timeout ]
 [ Debug ] fast/webgpu/fuzz-274290.html [ Skip ]
 [ Release ] fast/webgpu/fuzz-274290.html [ Pass Failure Timeout ]
+[ Debug ] fast/webgpu/fuzz-128396311.html [ Skip ]
+[ Release ] fast/webgpu/fuzz-128396311.html [ Pass Failure Timeout ]
 
 # Imported W3C HTML/DOM ref tests that are failing.
 imported/w3c/web-platform-tests/html/dom/elements/global-attributes/dir_auto-textarea-script-N-between-Rs.html [ ImageOnlyFailure ]