[php-src] PR #23401: Fix GH-23332: HashTable iterator counter loses its saturation

Pull Request: https://github.com/php/php-src/pull/23401 Author: iliaal zend_hash_iterator_pos_ex() decrements iter->ht's iterator counter while gating that decrement on ht's overflow state. A saturated counter can therefore drop below 0xff and later reach zero with iterators still live, so zend_array_destroy() frees the table without poisoning them. Wrong since ebf900a9ebd. Generators reach the same code as ArrayObject, so the test uses them and lives in Zend/tests. It is red only on a debug build; on a release build valgrind reports the invalid read and write. luizmenos found the same one-line change independently in #23399 and closed it in favor of this one, so NEWS credits them. Fixes GH-23332