ANDROID: rust_binder: allow duplicated freeze listener cookies

When libbinder creates freeze listeners, it uses the address of the
remote BpBinder object as the cookie for the freeze listener. This means
that if a freeze listener is removed and immediately re-added, then
libbinder will call BC_REQUEST_FREEZE_NOTIFICATION with a cookie that is
already present in the set of freeze listeners because the driver has
not yet replied with BR_CLEAR_FREEZE_NOTIFICATION_DONE.

This behavior is sub-optimal because it makes the protocol between the
libbinder and the kernel driver ambiguous when using the cookie to look
up a freeze listener. However, since libbinder listens to the same node
when cookies are reused, the ambiguity is arguably harmless. Thus,
support duplicate listeners as long as all listeners with the same
cookie are attached to the same node (which implies that only one of
them can be active because a node can only have one active listener
regardless of the cookie).

This implementation applies BC_FREEZE_NOTIFICATION_DONE to duplicates
before applying it to the active listener. Since the C implementation
uses a queue for delivered_freeze, this is consistent with the behavior
of the C implementation.

Bug: 423900220
Bug: 425638507
Change-Id: Id016f85e9aaab483b8f4ef8bf923811810cd57ce
Signed-off-by: Alice Ryhl <aliceryhl@google.com>