[php-src] PR #22926: ext/session: do not reuse session state a save handler tore down

Pull Request: https://github.com/php/php-src/pull/22926 Author: iliaal session_regenerate_id() runs the userland write or destroy handler, then the close handler, and keeps operating on PS(id) afterwards. Any of the three can call session_destroy(), and php_session_destroy() reaches php_rshutdown_session_globals() even when the recursive call was rejected, so PS(id) is released and set to NULL before control returns and zend_string_release_ex() dereferences it. Smallest reproducer is a SessionHandler subclass whose destroy() calls session_destroy(), followed by session_regenerate_id(true): SIGSEGV on 8.4, 8.5 and master. The check now sits after every handler has run, so the function warns and returns false with the session left closed. I swept the nine SessionHandler methods against fourteen session functions, 126 combinations with each method calling session_destroy() once. session_regenerate_id() was the only function that crashed, from the write, destroy and close handlers, and nothing in the sweep crashes after this change. The two tests jorgsowa adds in #22687 cover write() and destroy() returning false and still pass here.