fix: remove menu observer before destroying menu_controller_

[VerteDinde]

Description of Change

Follow up to #48351

A previous refactor uncovered a long-standing bug in MenuMac::~MenuMac() 's lifetime cycle: When MenuMac::~MenuMac() was being destroyed by GC, during implicit destruction of menu_controller_, it could trigger callbacks to the model through observer notifications. Menu::~Menu() ran after, removing the observer too late.

This PR moves the observer cleanup from Menu::~Menu() to MenuMac::~MenuMac(), removing the observer before menu_controller_ is destroyed and preventing callbacks during the deallocation.

Checklist

• PR description included
• I have built and tested this PR
• npm test passes
• tests are changed or added
• relevant API documentation, tutorials, and examples are updated and follow the documentation style guide
• PR release notes describe the change in a way relevant to app developers, and are capitalized, punctuated, and past tense.

Release Notes

Notes: Fixed an application crash on MacOS where the menu observer was not being properly removed before garbage collection.

[deepak1556]

LGTM as a targeted fix

A followup here would be to move the ownership of MenuModel to the subclasses MenuMac and MenuViews, most of the operations on the model happen through the MenuController and MenuRunner platform specific classes which are both owned by the respective subclasses, the base class api::Menu should just have a virtual access to model.

[release-clerk]

Release Notes Persisted

Fixed an application crash on MacOS where the menu observer was not being properly removed before garbage collection.

[trop]

I have automatically backported this PR to "40-x-y", please check out #49657

[trop]

I have automatically backported this PR to "41-x-y", please check out #49658