[GIT-PULLS] [php-src] PR #23399: Fix GH-23332: ArrayObject iterator saturation leads to UAF

Pull Request: https://github.com/php/php-src/pull/23399
Author: luizmenos

This fixes https://github.com/php/php-src/issues/23332

Before decrementing the iterator count, `zend_hash_iterator_pos_ex()` checked the overflow state of the wrong hash table. The check used the new hash table (`ht`), while the count was decremented on the iterator's current hash table (`iter->ht`).

When the current hash table's iterator count was saturated, this could make the count inconsistent and eventually lead to a use-after-free.