[php-src] PR #25458: Fix GH-25449: Keep by-ref containers out of converted FUNC_ARG fetches

Pull Request: https://github.com/php/php-src/pull/25458 Author: iliaal When g() returns by reference and the callee of f(g()['k']) is not known at compile time, OPcache passes null to f() and debug builds assert in FETCH_DIM_R. Since GH-20628, FETCH_DIM_R and FETCH_OBJ_R expect a VAR container to be unwrapped already, but pass 4 converts the FUNC_ARG fetch to its _R form while the container is still the VAR result of the by-ref call; an assignment by reference such as f(($y = &$x)['k']) hits the same assertion. Retype the call result to TMP, as the compiler emits for a known callee, and keep the FUNC_ARG fetch for any other producer except an already converted read fetch. Fixes #25449