[GIT-PULLS] [php-src] PR #23207: Fix GH-23204: use-after-free in implode() when __toString() destroys the array

Pull Request: https://github.com/php/php-src/pull/23207
Author: lazerg

php_implode() walks the array with ZEND_HASH_FOREACH_VAL while holding no reference on it. Converting a Stringable element runs user code, and if that code drops the last remaining reference to the array (`$a = null;` from __toString()), arData is freed and the next iteration reads freed memory.

Taking a reference on the table for the duration of the loop keeps it alive and turns an in-place mutation into a separation instead, same as zend_compare_symbol_tables() does around zend_hash_compare(). The reference is released after the pieces have been concatenated, since the collected zend_strings are still owned by the array until then.

Fixes #23204.