Fix use-after-free when __clone() retains the stylesheet copy - #23199

XSLTProcessor::importStylesheet() clones the stylesheet document through the object's clone handler and hands the copy to libxslt, which frees it with the stylesheet. A DOMDocument subclass __clone() runs while that copy is fully wired up and can stash either the copy itself or a node proxy into it, leaving a dangling pointer once the processor is destroyed. The clone must now be exclusively owned before libxslt takes it.

class D extends DOMDocument {
    public function __clone(): void { $GLOBALS['stash'] = $this; }
}
$d = new D;
$d->loadXML('<?xml version="1.0"?><xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"><xsl:template match="/"><out/></xsl:template></xsl:stylesheet>');
$p = new XSLTProcessor;
$p->importStylesheet($d);
$esc = $GLOBALS['stash'];
unset($GLOBALS['stash'], $p, $d);

That aborts with a double free on 8.4, 8.5 and master. Stashing $this->documentElement instead gives a silent read of freed memory in dom_objects_free_storage. 8.3 is unaffected because it copies at the libxml level and never builds a PHP object for the copy.