fix: prevent double-free in merge_sort (CVE-2021-31996)

[baima365-web]

Summary

merge_sort::merge() uses ptr::read() to extract elements from left/right vectors. This moves ownership out of the Vec, causing double-free when the Vec is dropped.

PoC

let mut list = vec![String::from("hello"), String::from("world")];
algorithmica::merge_sort::merge_sort(&mut list, 0, list.len()-1, &|a,b| a.lt(b));
// Double-free panic!

Fix

1. Add Clone bound to merge() and merge_sort()
2. Replace ptr::read() with ptr::read().clone() to copy instead of move
3. Added regression test for String type (T: Drop)

References

• RUSTSEC-2021-0053 / CVE-2021-31996
• Issue 'merge_sort::merge()' crashes with double-free for T: Drop #1: 'merge_sort::merge()' crashes with double-free for T: Drop #1