[php-src] PR #23701: Fix GH-22049: Prevent crash when cloning unserialized ArrayIterator with numeric properties

Pull Request: https://github.com/php/php-src/pull/23701 Author: prateekbhujel Closes #22049 When ArrayIterator or ArrayObject is unserialized with numeric dynamic properties, object_properties_load previously inserted properties using zend_hash_index_update. When object properties were uninitialized, this initialized the properties table as a packed array. In Zend Engine, object properties tables are expected to be mixed hash tables because dynamic property lookup uses string keys. Furthermore, zend_objects_clone_members iterates old_object properties using ZEND_HASH_MAP_FOREACH_KEY_VAL, which assumes a mixed hash map with 32 byte Bucket structs. Iterating a packed array with that macro led to zval type bytes being misinterpreted as key pointers, resulting in memory corruption and SIGSEGV during clone. This fix: 1. Converts numeric property keys to strings in object_properties_load so dynamic properties are stored as string keys in a mixed hash table. 2. Adds a defensive check in zend_objects_clone_members to convert packed tables to hash maps before iteration. 3. Adds a regression test covering ArrayIterator and ArrayObject cloning after unserialization.