[DH] Fix pick_up_fragment crash on Vengeance with multiple threads

consume_soul_fragments() deletes fragments via remove() but didn't
cancel a pending pick_up_fragment event that may hold a pointer to
one of them. The event then dereferences freed memory.

consume_nearby_soul_fragments() already cancels the event correctly;
this brings consume_soul_fragments() in line.

Author: taherbert

engine/class_modules/sc_demon_hunter.cpp

@@ -12104,6 +12104,10 @@ unsigned demon_hunter_t::consume_soul_fragments( soul_fragment type, bool instan
     }
   }
 
+  // Cancel any pending pick_up_fragment event since consume() below will
+  // delete the fragment it may be referencing, causing a use-after-free.
+  event_t::cancel( soul_fragment_pick_up );
+
   for ( auto& it : candidates )
   {
     it->consume( instant );