fix(esp_event): protect is_handler_registered traversal with mutex (SEC-219)

esp_event_is_handler_registered() walked loop_nodes, base_nodes, id_nodes
and handler lists with no lock held, then released an unowned mutex at the
'out:' label via xSemaphoreGive().

Concurrent register/unregister/delete operations can free handler nodes
during the unlocked walk (SLIST UAF). The xSemaphoreGive on an unowned
recursive mutex corrupts the recursive call-count of any task that
legitimately holds the mutex.

Fix:
- Take loop->mutex with xSemaphoreTakeRecursive before the traversal.
- Replace xSemaphoreGive at the 'out:' label with xSemaphoreGiveRecursive
  so every exit path holds the mutex for exactly one balanced take/give.

Closes SEC_219

components/esp_event/esp_event_private.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2018-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2018-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -20,6 +20,8 @@ bool esp_event_is_handler_registered(esp_event_loop_handle_t event_loop, esp_eve
     esp_event_id_node_t* id_node;
     esp_event_handler_node_t* handler;
 
+    xSemaphoreTakeRecursive(loop->mutex, portMAX_DELAY);
+
     SLIST_FOREACH(loop_node, &(loop->loop_nodes), next) {
         SLIST_FOREACH(handler, &(loop_node->handlers), next) {
             if (event_base == ESP_EVENT_ANY_BASE && event_id == ESP_EVENT_ANY_ID && handler->handler_ctx->handler == event_handler) {
@@ -52,6 +54,6 @@ bool esp_event_is_handler_registered(esp_event_loop_handle_t event_loop, esp_eve
     }
 
 out:
-    xSemaphoreGive(loop->mutex);
+    xSemaphoreGiveRecursive(loop->mutex);
     return result;
 }