Fix ASAN flake (#26864)

Properly track lifetime and ownership of acceptor, leading to
the elimination of a flake we're seeing in prod.

src/core/ext/transport/chttp2/server/chttp2_server.cc

@@ -127,7 +127,7 @@ class Chttp2ServerListener : public Server::ListenerInterface {
       static void OnHandshakeDone(void* arg, grpc_error_handle error);
       RefCountedPtr<ActiveConnection> const connection_;
       grpc_pollset* const accepting_pollset_;
-      grpc_tcp_server_acceptor* const acceptor_;
+      grpc_tcp_server_acceptor* acceptor_;
       RefCountedPtr<HandshakeManager> handshake_mgr_
           ABSL_GUARDED_BY(&connection_->mu_);
       // State for enforcing handshake timeout on receiving HTTP/2 settings.
@@ -320,6 +320,7 @@ Chttp2ServerListener::ActiveConnection::HandshakingState::HandshakingState(
 Chttp2ServerListener::ActiveConnection::HandshakingState::~HandshakingState() {
   grpc_pollset_set_del_pollset(interested_parties_, accepting_pollset_);
   grpc_pollset_set_destroy(interested_parties_);
+  gpr_free(acceptor_);
 }
 
 void Chttp2ServerListener::ActiveConnection::HandshakingState::Orphan() {
@@ -477,6 +478,7 @@ void Chttp2ServerListener::ActiveConnection::HandshakingState::OnHandshakeDone(
     handshaking_state_ref = std::move(self->connection_->handshaking_state_);
   }
   gpr_free(self->acceptor_);
+  self->acceptor_ = nullptr;
   OrphanablePtr<ActiveConnection> connection;
   if (free_resource_quota && resource_user != nullptr) {
     grpc_resource_user_free(resource_user, GRPC_RESOURCE_QUOTA_CHANNEL_SIZE);
@@ -744,6 +746,8 @@ void Chttp2ServerListener::OnAccept(void* arg, grpc_endpoint* tcp,
   }
   auto connection =
       MakeOrphanable<ActiveConnection>(accepting_pollset, acceptor, args);
+  // We no longer own acceptor
+  acceptor = nullptr;
   // Hold a ref to connection to allow starting handshake outside the
   // critical region
   RefCountedPtr<ActiveConnection> connection_ref = connection->Ref();