ext/gd: keep the brush and tile images alive while the destination uses them - #24444

imagesetbrush() and imagesettile() store a raw pointer to the brush or tile image in libgd, but the destination GdImage keeps no reference to it. Once the brush object is released, drawing with IMG_COLOR_BRUSHED or IMG_COLOR_TILED reads freed memory. Keep a reference to both images in the destination object and expose them to the GC.

To reproduce on PHP 8.5.4

<?php
$im = imagecreatetruecolor(20, 20);
$brush = imagecreatetruecolor(4, 4);
imagefill($brush, 0, 0, 0xff0000);
imagesetbrush($im, $brush);
unset($brush);
$junk = [];
for ($i = 0; $i < 50; $i++) { $j = imagecreatetruecolor(4, 4); imagefill($j, 0, 0, 0x00ff00); $junk[] = $j; }
imageline($im, 2, 10, 17, 10, IMG_COLOR_BRUSHED);
printf("%06x\n", imagecolorat($im, 5, 10));

Before: 00ff00, the pixels of another image

After: ff0000