MDEV-33325 fixup

ibuf_remove_free_page(): Correct the calculation of root_savepoint().
The first entry acquired by ibuf_tree_root_get() will be ibuf.index.lock
and not the change buffer root page.

Thanks to Matthias Leich for finding this bug in RQG.
Unfortunately, this code is very difficult to cover
in our regression test suite.

storage/innobase/ibuf/ibuf0ibuf.cc

@@ -1888,13 +1888,13 @@ static void ibuf_remove_free_page()
 		return;
 	}
 
-	const auto root_savepoint = mtr.get_savepoint();
 	buf_block_t* root = ibuf_tree_root_get(&mtr);
 
 	if (UNIV_UNLIKELY(!root)) {
 		goto early_exit;
 	}
 
+	const auto root_savepoint = mtr.get_savepoint() - 1;
 	const uint32_t page_no = flst_get_last(PAGE_HEADER
 					       + PAGE_BTR_IBUF_FREE_LIST
 					       + root->page.frame).page;