[ikow]

Fixes #1792.

js_array_find() retains val after releasing it on a non-matching
iteration. If the host interrupt fires at the next loop poll, shared exception
cleanup releases the stale value a second time. This removes a reference still
owned by the source object and can leave attacker-visible state dangling.

Clear val immediately after its normal release, matching the ownership
pattern already used by the other array iteration helpers. The change applies
to find, findIndex, findLast, and findLastIndex, which share this
implementation.

This independently removes the memory-safety half of the interrupt/recovery
chain described in the private report. Preservation of uncatchable exceptions
in Promise paths is covered separately by #1776.

Test plan:

• Ran the public-API interrupt/reuse reproducer against current master: a
  source value was reclaimed and the release build exited with SIGSEGV.
• Ran the same reproducer after this patch: the source remained unchanged and
  the process exited normally.
• Ran run-test262 -m -c tests.conf: the only failure was the existing macOS
  test_std.js second-pipe-handler assertion, also reproduced on unmodified
  master.