[php-src] PR #23348: Fix UAF when setAttributeNS() frees a wrapped attribute child

Pull Request: https://github.com/php/php-src/pull/23348 Author: iliaal Dom\Element::setAttributeNS() replaces an existing attribute's value by calling xmlSetNsProp() directly, and libxml2 frees the attribute's child list there. Nothing unlinks the children that still carry a PHP wrapper first, so a live Dom\Text goes on pointing at freed memory: it reports the new attribute text and claims to still be attached. dom_set_attribute_ns_legacy() has always unlinked them, and the modern setAttribute() replaces the value through dom_remove_all_children(), so only the modern namespace-aware setter is missing the step. No DTD and no entity reference are needed. A single-text-child attribute is enough, which is why the test builds one rather than reusing the GH-23331 shape. Independent of php/php-src#23337, which repairs node_list_unlink() itself. Neither fix needs the other, but an attribute holding TEXT/ENTITY_REF/TEXT needs both: with the two applied that case is valgrind-clean, and with either one alone valgrind still reports an invalid read through the surviving wrapper.