## Summary

Fix two reference counting bugs in the legacy DAC's `DefaultCOMImpl`
template class, remove the corresponding compat workaround in the cDAC,
bump clrmd, and implement `CLRDATA_REQUEST_REVISION` in the cDAC.

> [!NOTE]
> This PR description was generated with the help of Copilot.

## Sibling PRs:
- dotnet/diagnostics#5789 (merged) — Bump clrmd
in diagnostics, adapt to 4.x API changes
- microsoft/clrmd#1414 (merged) — Fix
`ParseGenericTypeArgumentNames` for nested generic types
- microsoft/clrmd#1416 (merged) — Fall back to
MethodTable when generic type resolution produces a placeholder

## Bug 1: `Release()` uses post-decrement (dacimpl.h)

`DefaultCOMImpl::Release()` used post-decrement (`mRef--`) instead of
pre-decrement (`--mRef`):

```cpp
// Before (bug):
ULONG res = mRef--;  // captures value BEFORE decrement
if (res == 0)        // never true when mRef was 1
    delete this;     // object is never freed
```

Per the [IUnknown::Release
contract](https://learn.microsoft.com/en-us/windows/win32/api/unknwn/nf-unknwn-iunknown-release),
`Release` must return the **new** reference count and free the object
when it reaches 0. The post-decrement meant objects were never freed — a
memory leak affecting all `DefaultCOMImpl`-derived classes
(`DacHandleWalker`, `DacStackReferenceWalker`, `DacMemoryEnumerator`
subclasses, `DacMethodTableSlotEnumerator`,
`DacStackReferenceErrorEnum`).

## Bug 2: `DacMethodTableSlotEnumerator` missing `QueryInterface`
(request.cpp)

`GetMethodTableSlotEnumerator` returned the object via raw pointer
assignment without calling `QueryInterface`/`AddRef`, leaving `mRef` at
0:

```cpp
// Before (bug):
*enumerator = methodTableSlotEnumerator;  // mRef stays 0
```

Every other `DefaultCOMImpl` subclass correctly uses `QueryInterface`
before returning, which calls `AddRef` to give the caller an owning
reference. Fixed to match that pattern.

## cDAC compat removal (SOSDacImpl.cs)

The cDAC's `GetHandleEnum` and `GetHandleEnumForTypes` previously called
`ComInterfaceMarshaller.ConvertToUnmanaged` to intentionally leak a ref
count, matching the legacy DAC's broken behavior. Now that the legacy
bug is fixed, this compat workaround is removed.

## Version bump and cDAC revision

- Bumps `CLRDATA_REQUEST_REVISION` from 9 to 10 in the legacy DAC so
that ClrMD can detect the fixed ref counting behavior via
`IXCLRDataProcess::Request`.
- Implements `CLRDATA_REQUEST_REVISION` directly in the cDAC's
`SOSDacImpl.IXCLRDataProcess.Request` (with DEBUG validation against the
legacy DAC) so consumers get the correct revision without requiring the
legacy DAC fallback.

## ClrMD bump

Updates `Microsoft.Diagnostics.Runtime` from `3.1.512801` to
`4.0.0-beta.26210.1`. The new version includes:
- CLRDATA_REQUEST_REVISION 10 detection to avoid double-freeing
(microsoft/clrmd#1398)
- `ParseGenericTypeArgumentNames` fix for nested generic types
(microsoft/clrmd#1414)
- `GetTypeByName` cached generic instantiation fix
(microsoft/clrmd#1412)
- Canon fallback to MethodTable for compiler-generated types
(microsoft/clrmd#1416)

## cdacstress.cpp double Release removal

Removes the compensating double `pEnum->Release()` in `CollectStackRefs`
that was working around the broken post-decrement in
`DefaultCOMImpl::Release()`.

---------

Co-authored-by: Max Charlamb <maxcharlamb@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>