New bug class: Accessing rend_data/hs_ident after marking for close a circuit
See #30771 (moved) for an example of this issue:
circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_FINISHED);
/* close any other intros launched in parallel */
rend_client_close_other_intros(rend_data_get_pk_digest(circ->rend_data,
NULL));
It seems to be caused by a bad interaction between #29034 (moved) and #28780 (moved), plus some naughty v2 code. The v2 code marks the circuit as closed and then tries to access rend_data out of it, but because of #28780 (moved) the mark for close repurposes the circuit to a padding circuit instead, and then because #29034 (moved) we also clean its rend_data. This causes the crash.
We should make sure that this pattern is impossible in other parts of the code, so that we don't assert out again, or even worse access freed memory.