mesa: fix buffer overrun in SavedObj texture obj array
Fixes: 3be42f9c ("mesa: rewrite glPushAttrib/glPopAttrib to get rid of malloc") Closes: mesa/mesa#5621 Reviewed-by:Ilia Mirkin <imirkin@alum.mit.edu> Part-of: <mesa/mesa!13773> (cherry picked from commit 9d9de15a)