fix(gc): swap enumeration order in gc mark phase to avoid TOCTOU bug

[GrizzlT]

Description

Currently, it is possible for the gc to accidentally delete blobs that were tagged using something like:

let tag = store.blobs().add_slice(buffer).with_named_tag(b"my-tag-name").await?;

This can happen due to a TOCTOU bug in the mark phase of the gc (see #247). Because named tags are enumerated before temp tags in a check for blob liveness, it is possible to queue the following order of irpc messages:

Action	Origin
ListNamedTags	GC
SetNamedTag	AddProgress
ClearTempTag	AddProgress
ListTempTags	GC

The gc is completely blind to the tag added in this sequence of messages. The elegant fix is to swap the order of enumeration into the following:

Action	Origin
ListTempTags	GC
SetNamedTag	AddProgress
ClearTempTag	AddProgress
ListNamedTags	GC

Now, regardless of whether the temp tag is seen by the gc or not, the named tag is guaranteed to be seen by the gc and thus it becomes impossible to accidentally delete blobs as explained in the original problem statement.

Fixes #247.

Breaking Changes

Notes & open questions

Does it make sense to try and write a unit test for this bug to prevent it from returning in the future? Or does it suffice to add internal documentation to the code?

Change checklist

• Self-review.
• Documentation updates following the style guide, if relevant.
• Tests if relevant.
• All breaking changes documented.