[GIT-PULLS] [php-src] PR #22680: Fix GH-22678: array_multisort() use-after-free on mutating comparator

Pull Request: https://github.com/php/php-src/pull/22680
Author: iliaal

array_multisort() borrows each input array's buckets without a refcount, then runs the comparator; under SORT_STRING that reaches Stringable::__toString(), so a callback that unsets or reassigns the array frees its backing store and elements mid-sort (use-after-free in the comparator, and a write-back through the freed table in the restructure). Holding a reference on each input HashTable for the duration of the sort fixes it, mirroring zend_array_sort_ex() (GH-16648); HT_ALLOW_COW_VIOLATION lets the in-place restructure repack the still-referenced table. Fixes #22678