[GIT-PULLS] [php-src] PR #22710: Fix use-after-free when a destructor bails out during zend_hash_clean()

Pull Request: https://github.com/php/php-src/pull/22710
Author: iliaal

zend_hash_clean() runs each element's destructor and resets the table only after the loop, so a zend_bailout from a destructor (memory_limit, timeout, E_USER_ERROR) leaves already-destroyed slots in a still-reachable table and shutdown teardown frees them a second time. session_unset() on a $_SESSION whose value has a bailing destructor reproduces it. The fix moves each element into a local and clears its slot to IS_UNDEF before running the destructor, so a bailed-out clean leaves consumed slots that teardown skips; the buffer and packed/map shape are preserved, so cleaning during iteration is unaffected.