feat(execution-context): reset() to reuse one context across inputs

[pigri]

Why

An ExecutionContext holds one value slot per scheme field, and allocating
and zeroing that table dominates the cost of filling one. Measured on an
84-field scheme:

ExecutionContext::new	316 ns
clear() on an existing one	52 ns

That 316 ns is more than every field write in a typical bind combined, and it
is paid before the first one.

clear() already keeps the allocation, but it cannot help a caller in a loop:
the context's 'e is fixed to the data it was last filled from, so the next
input — borrowed from somewhere else — will not typecheck against it. Callers
in that shape (one context per packet, per request, per row) end up allocating
a fresh context every time.

What

reset() clears the context and re-labels it for a new borrow lifetime, so
one allocation can be handed from input to input:

let mut spare = ExecutionContext::new(&scheme);
for input in inputs {
    let mut ctx = spare.reset();
    ctx.set_field_value(field, &input.value)?;
    // ... execute filters against ctx ...
    spare = ctx.reset();
}

In the caller this PR was written for — a per-packet firewall bind over an
84-field scheme — this takes binding a packet from 616 ns to 439 ns (−29%)
with no other change.

Soundness

clear() has already replaced every value with None, dropping each
LhsValue<'e>, and cleared the list matchers. The remaining members do not
borrow from 'e: scheme is owned, list_matchers are 'static trait
objects, and user_data is U. With nothing reachable that borrows from
'e, re-labelling the lifetime cannot produce a dangling reference, and the
two types differ only in that parameter, so their layout is identical.

test_reset_reuses_one_context_across_borrows exercises the case that would
be UB if this were wrong — each iteration borrows from a String that is
dropped before the next iteration begins — and it passes under Miri with
-Zmiri-strict-provenance.

[linear-code]

SYN-64