tls: use after free in tls_wrap

The root cause is that `req_wrap` is created in `StreamBase::Write`
and passed to `TLSWrap::DoWrite`. In the TLS case the object gets
disposed and replaced with a new instance, but the caller's pointer is
never updated. When the `StreamBase::Write` method returns, it returns
a pointer to the freed object to the caller. In some cases when the
object memory has already been reused an assert is hit in
`WriteWrap::SetAllocatedStorage` because the pointer is non-null.

PR-URL: https://github.com/nodejs/node/pull/18860
Refs: https://github.com/nodejs/node/pull/18676


Reviewed-By: Anna Henningsen <anna@addaleax.net>