Update the card table scanning for header-only card marks.

Previously, the card table accessors assumed that objects had either
their header marked or would be marked exactly.  As such, after
reckoning a marked card the scan would back up until it found an
object header and then move forward blackening each object within the
address range of the marked card.

Following a recent change we exclusively mark headers.  The scan only
has to move forward until the end of a card.  This saves scanning time
as dlmalloc's binning may leave large segments of the heap unused.  It
is not uncommon for hundreds of cards to be spanned when backing up to
the first live object below a marked card.

In addition, this change fixes the card table verifier to search the
mark stack for gray objects.  It is permissible for roots to point to
white objects on unmarked cards.  This was incorrectly treated as an
error.

Change-Id: Ia6b6ee2012e381d644b8b3f38b39d746749ea47a