buf_flush_remove_pages(), buf_flush_dirty_pages(): Because
buf_page_t::state() is protected by buf_pool.mutex, which we
are not holding, the state may be BUF_BLOCK_REMOVE_HASH when
the page is being relocated. Let us relax these assertions
similar to buf_flush_validate_low().

The other in_file() assertions in buf0flu.cc look valid.