AK: Avoid UAF for consecutive SinglyLinkedList removals

The iterator returned by SinglyLinkedList::remove() left `m_prev`
default-initialized to `nullptr`. If the caller removed another element
without first advancing, the previous node's next pointer was left
dangling to the freed node.

This caused a UAF in FinalizationRegistry's `remove_by_token()` when
two consecutive records shared an unregister token.

AK/SinglyLinkedList.h

@@ -281,6 +281,7 @@ public:
         auto* next = node->next;
         new_iterator.m_node = next;
         new_iterator.m_next = next ? next->next : nullptr;
+        new_iterator.m_prev = iterator.m_prev;
         delete node;
         return new_iterator;
     }