Fix GC_finalized_malloc.

This reverts 63fd11d "Move finalizer closure to the end of objects.".

The finalizer closure is placed in the first word in order to use the lower
bits to distinguish live objects from objects on the free list.  The
downside of this is that we need on-word offset interior pointers, and that
GC_base does not return the start of the user region.