runtime: heap `mspan` limit is set too late, causing data race between span allocation and conservative scanning [1.24 backport]

[gopherbot]

@mknyszek requested issue #74288 to be considered for backport to the next 1.24 minor release.

@gopherbot Please open backport issues for Go 1.23 and Go 1.24.

This problem can cause rare random crashes in the runtime with no workaround.