tracing: assert against mixing tracers

Creating a child with a different Tracer than the parent is
broken because the child span can leak: if the parent is Finish()ed
first, the child gets inserted into the parent's registry:
https://github.com/cockroachdb/cockroach/blob/d60e17a7047bb16b6aed1585bc5d274bd748d04e/pkg/util/tracing/crdbspan.go#L186

However, when the child gets Finish()ed, we attempt to remove it from
its Tracer's registry.

Mixing Tracers like this seems fundamentally a bad idea, because it is
inherently unclear what the behavior with respect to the registries
should be. This patch adds an assertion at span creation time checking
that the two Tracers involved are one and the same.

Release note: None

pkg/util/tracing/tracer.go

@@ -616,6 +616,16 @@ func (t *Tracer) startSpanGeneric(
 			// WithParentAndAutoCollection.
 			panic("invalid sterile parent")
 		}
+		if opts.Parent.Tracer() != t {
+			// Creating a child with a different Tracer than the parent is not allowed
+			// because it would become unclear which active span registry the new span
+			// should belong to. In particular, the child could end up in the parent's
+			// registry if the parent Finish()es before the child, and then it would
+			// be leaked because Finish()ing the child would attempt to remove the
+			// span from the child tracer's registry.
+			panic(fmt.Sprintf("attempting to start span with parent from different Tracer. parent: %s, child: %s",
+				opts.Parent.OperationName(), opName))
+		}
 	}
 
 	// Are we tracing everything, or have a parent, or want a real span, or were