recover BST leetcode, O(n) and constant space