ZHeapIteratorOopClosure does not handle native access properly

`ZHeapIteratorOopClosure` is applied to all oops (to live objects) in the heap. In order to find all those objects, ZGC does a complete objects graph traversal, similar to marking. For each location that contains an oop, `load_oop(oop* p)` is called, which loads the oop, effetively deref `p` plus proper GC barrier. Currently, `load_oop` treats all passed-in arguments as in-heap; IOW, `p` live in the heap. However, during iterating over CLD, some oops could live in the metaspace (outside the heap).