Fix memory leaks in model_based_opt def ref-counting

Three bugs in the def ref-counting infrastructure:

1. dec_ref() incremented (++) instead of decrementing (--) the ref count,
   so objects were never freed.

2. def_ref lacked copy and move constructors, so the compiler-generated
   default copy just copied the raw pointer without inc_ref. This caused
   use-after-free when def_ref values were copied into vectors.

3. Compound def types (add_def, mul_def, div_def) lacked destructors to
   dec_ref their children. Added virtual destructor to base def class
   and child-releasing destructors to compound types.

Fixes the memory leak from #7027 (model_based_opt.cpp:81).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

src/math/simplex/model_based_opt.cpp

@@ -89,7 +89,7 @@ namespace opt {
     }
     void model_based_opt::def::dec_ref() {
         SASSERT(m_ref_count > 0);
-        ++m_ref_count;
+        --m_ref_count;
         if (m_ref_count == 0) 
             dealloc(this);            
     }