How do you handle memory allocation in safety-critical space flight software? Why is dynamic memory allocation (malloc) generally avoided?