Fix deepclone_to_array() on objects released during the walk

[nicolas-grekas]

Found by the differential fuzzing of the polyfill against the extension.

The pool of deepclone_to_array() is keyed by object handle, but didn't keep the objects alive: the ones that __serialize(), __sleep() or Serializable::serialize() create and release got their handle reused by the next ones, which were merged into the first:

class Fresh {
    function __construct(public $n) {}
    function __serialize(): array { return ['o' => (object) ['n' => $this->n]]; }
    function __unserialize(array $d): void { $this->n = $d['o']->n; }
}
deepclone_from_array(deepclone_to_array([new Fresh(1), new Fresh(2)])); // both got n=1

Two DatePeriod in one graph also gave a payload that couldn't be decoded. Pool entries now hold a reference to their object until the payload is built. They don't store the class name anymore, which keeps them at 48 bytes: -0.4% to -0.6% instructions on graphs of 3000 to 5000 objects. As a side effect, Serializable::serialize() sees the objects met before as back-references, like with serialize().

__serialize() is also called whatever its visibility, like serialize() does, and references that nothing else holds, eg after unset() of the other side, are exported as values, like serialize() and the polyfill do, instead of taking a reference id.