Fix use-after-free serializing an array grown by an element's hook

[iliaal]

The IS_ARRAY case of serialize() walks the array's HashTable without holding a reference while it recurses into user hooks, so a __serialize() (or __sleep(), or Serializable::serialize()) that grows the same array through a by-reference alias reallocs the backing store mid-walk and the walk then reads freed memory. The object case and var_dump/var_export already hold a ref across the walk; this adds the same for arrays. Triggering it needs an attacker-defined mutating hook, so it is an ordinary memory-safety bug, not a security issue. The test is an ASan/valgrind canary: a normal build usually reads the freed memory and passes.

Reproducer (invalid read in php_var_serialize_nested_data under ASan/valgrind):

<?php
class G {
    public $ref;
    public function __serialize(): array {
        for ($i = 0; $i < 128; $i++) $this->ref[] = 'x' . $i;
        return ['d' => 1];
    }
}
$g = new G();
$inner = [$g, 'tail'];
$g->ref = &$inner;
$top = [&$inner];
serialize($top);

[iliaal]

Superseded by php#22714.