Fix unsound observer initialization

[chescock]

Objective

Fix potential UB during observer initialization that was noticed in #25507 (comment).

When calling System::initialize on an observer system, we pass &mut World while also holding a &mut to the observer system itself. This is usually fine, since none of the first-party systems or system params will do anything invalid. Even adding observers is fine because the system is stored behind a box and won't be moved if we reallocate a table. But it's valid for a system to despawn the observer during its own initialize, which would then deallocate the System while it was running initialize!

Solution

Store the system in the Observer component in an Option, and remove it before calling initialize, so that we can hold &mut World without conflict.

Note that we were already doing that for conditions, so this does not need an additional component lookup. I was even able to remove one lookup by replacing the system and conditions at the same time.

Also skip the call to register_observer if the observer was despawned before then. I didn't investigate whether that call would actually cause problems, but I can't see any way that it would be helpful in that case.

[alice-i-cecile]

Can you add a regression test for the pathological observer please? That seems like a nice little addition to the miri test suite. Seems like a nice fix otherwise though!

[alice-i-cecile]

CI failure, then I'll merge <3

[chescock]

CI failure, then I'll merge <3

Augh, conditional compilation again! Hopefully that push fixed it.

There is some danger that I'll make a PR soon to make fn refresh_hotpatch() always exist and just be a no-op when hotpatching is disabled, so that this doesn't bite anyone again...