[php-src] PR #23199: Fix use-after-free when __clone() retains the stylesheet copy

Pull Request: https://github.com/php/php-src/pull/23199 Author: iliaal XSLTProcessor::importStylesheet() clones the stylesheet document through the object's clone handler and hands the copy to libxslt, which frees it with the stylesheet. A DOMDocument subclass __clone() runs while that copy is fully wired up and can stash either the copy itself or a node proxy into it, leaving a dangling pointer once the processor is destroyed. The clone must now be exclusively owned before libxslt takes it. ```php class D extends DOMDocument { public function __clone(): void { $GLOBALS['stash'] = $this; } } $d = new D; $d->loadXML('<?xml version="1.0"?><xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"><xsl:template match="/"><out/></xsl:template></xsl:stylesheet>'); $p = new XSLTProcessor; $p->importStylesheet($d); $esc = $GLOBALS['stash']; unset($GLOBALS['stash'], $p, $d); ``` That aborts with a double free on 8.4, 8.5 and master. Stashing $this->documentElement instead gives a silent read of freed memory in dom_objects_free_storage. 8.3 is unaffected because it copies at the libxml level and never builds a PHP object for the copy.