[scudo] Fix the logic of pushing blocks of BatchClass

BatchClass is used to manage the free blocks for each size class. It's a
little bit tricky when it has to manage the free blocks of BatchClass.
In general, BatchClass block records the addresses of free blocks. In
order not to waste additional block to record the blocks in BatchClass,
it's self contained, i.e., it'll record its own address. The safety is
maintained by 2 preconditions,

  1. If a block is used to record other BatchClass blocks, it'll also
     record the address itself
  2. While allocating free blocks, all the recorded blcoks will be
     allocated together, which means there's no partial allocation

This CL fixes the violation of 1. and then we can push the free blocks
without having to push them in batches.

Differential Revision: https://reviews.llvm.org/D141956