[php-src] Issue #21831: Uaf in SplObjectStorage::removeAllExcept() with custom getHash()

Issue: https://github.com/php/php-src/issues/21831
Author: iluuu1994

### Description

Originally reported by @kdsjZh.

The following code:

```php
<?php

class S extends SplObjectStorage {                                                                                   
    public $other;                                                                                                   
 
    public function getHash($obj): string {                                                                          
        if ($this->other) {                               
            $this->other->offsetUnset($obj);  // free element                                                        
            $this->other = null;                                                                                     
        }
        return "x";  // not in this storage -> enter if-block                                                        
    }                                                                                                                
}
                                                                                                                     
$storage = new SplObjectStorage();                        
$obj = new stdClass();
$storage->offsetSet($obj);

$filter = new S();                                                                                                   
$filter->other = $storage;
                                                                                                                     
$storage->removeAllExcept($filter);  // UAF here
```

### PHP Version

```plain
-
```

### Operating System

_No response_