fix: prevent panic on inner attributes in a loop body inside a closure

[shulaoda]

Summary

Closes #6209.

A block has nowhere to store attributes, so an inner attribute written in a loop body is attached to the loop expression with AttrStyle::Inner. rewrite_closure_with_block wraps the closure body in an artificial block and forwards the body's attributes to it. That assumes the || #[attr] foo() shape, where the attributes precede the body, which is what the artificial block's span is widened to cover. When an inner attribute is forwarded instead, visit_block emits it and pushes last_pos past it. The loop statement that follows starts before that point, so push_rewrite asks to format a backwards span.

Filtering the body's attributes to the outer ones is a no-op for the shape the code was written for, since rewrite_block_with_visitor already narrows what it receives to inner attributes.

Review notes

Inner attributes are still dropped from the output, so the expected output in the new tests does not contain them. That is a separate pre-existing bug (#5973) which affects loops with or without a closure and is not touched here.

#6010 fixes that one by plumbing the loop's inner attributes through ControlFlow. I applied it on top of this branch to check the two compose: there is no panic and the attributes come back, so the only change is that the expected output added here will need updating when #6010 lands.