[php-src] PR #25357: ext/dom: Fix use-after-free when an XPath callback modifies the document

Pull Request: https://github.com/php/php-src/pull/25357 Author: iliaal A php:function() callback of DOMXPath or Dom\XPath runs while libxml2 builds the node-set, so a callback that removes nodes, assigns textContent, removes attributes or drops the last reference to a detached subtree frees nodes the evaluation still uses. While such an evaluation runs, the trees it can reach are read-only, and modifying them throws a DOMException with NO_MODIFICATION_ALLOWED_ERR (an Error through SimpleXML). New nodes and document properties stay modifiable, so building and returning a fragment from a callback still works. This adds fields to php_libxml_ref_obj, php_libxml_node_ptr and php_dom_xpath_callbacks, so it targets master. XSLT gets the same protection in a follow-up PR. Not covered: an id() node-set spanning two detached subtrees where a callback drops the last reference to the other one, and user error handlers during an evaluation with no PHP functions registered. Reported by Hem1700.