tu: Fix push_set host memory leak on command buffer reset

Addresses:
```
Direct leak of 192 byte(s) in 1 object(s) allocated from:
    #0 0x7fbe5e4230 in __interceptor_realloc
       ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
    waydroid#1 0x7fbd008bf4 in vk_default_realloc
       ../src/vulkan/util/vk_alloc.c:37
    waydroid#2 0x7fbbabb2fc in vk_realloc ../src/vulkan/util/vk_alloc.h:70
    waydroid#3 0x7fbbaead38 in tu_push_descriptor_set_update_layout
       ../src/freedreno/vulkan/tu_cmd_buffer.cc:3173
    waydroid#4 0x7fbbaeb0b4 in tu_push_descriptor_set
       ../src/freedreno/vulkan/tu_cmd_buffer.cc:3203
    waydroid#5 0x7fbbaeb500 in tu_CmdPushDescriptorSet2KHR(VkCommandBuffer_T*,
       VkPushDescriptorSetInfoKHR const*)
../src/freedreno/vulkan/tu_cmd_buffer.cc:3235
    waydroid#6 0x7fbbe35c80 in vk_common_CmdPushDescriptorSetKHR
       ../src/vulkan/runtime/vk_command_buffer.c:300
```
seen in:
dEQP-VK.binding_model.shader_access.secondary_cmd_buf.bind.with_push.sampler_mutable.tess_eval.multiple_discontiguous_descriptors.1d_array

Fixes: 03294e1 ("turnip: Keep a host copy of push descriptor sets.")
Signed-off-by: Karmjit Mahil <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32057>
(cherry picked from commit 53c2d5e426d8a5b919ea3c64bad9e46b354b2fc9)

.pick_status.json

@@ -624,7 +624,7 @@
         "description": "tu: Fix push_set host memory leak on command buffer reset",
         "nominated": true,
         "nomination_type": 1,
-        "resolution": 0,
+        "resolution": 1,
         "main_sha": null,
         "because_sha": "03294e1dd1cd0e3de2bfe45e91765ee56d217d4a",
         "notes": null

src/freedreno/vulkan/tu_cmd_buffer.cc

@@ -2339,6 +2339,7 @@ tu_reset_cmd_buffer(struct vk_command_buffer *vk_cmd_buffer,
          vk_descriptor_set_layout_unref(&cmd_buffer->device->vk,
                                         &cmd_buffer->descriptors[i].push_set.layout->vk);
       }
+      vk_free(&cmd_buffer->device->vk.alloc, cmd_buffer->descriptors[i].push_set.mapped_ptr);
       memset(&cmd_buffer->descriptors[i].push_set, 0, sizeof(cmd_buffer->descriptors[i].push_set));
       cmd_buffer->descriptors[i].push_set.base.type = VK_OBJECT_TYPE_DESCRIPTOR_SET;
       cmd_buffer->descriptors[i].max_sets_bound = 0;