Fix use-after-free in XPath php:function argument nodes

[iliaal]

When an XPath php:function() callback removes a node passed to it as an argument, the node is freed the moment the callback returns because the argument cleanup drops the only proxy holding it, while libxml still references that node in the running evaluation's node-set. The read inside xmlXPathEvalExpression() is then a use-after-free. Returned nodes are already kept alive in the registry node list for the evaluation's duration; argument node and node-set proxies now get the same treatment.

[devnexen]

question: args now land in node_list, but DOMXPath::query/evaluate never flushes it (only XSLT does). So a long-lived DOMXPath passing nodes to php:function callbacks holds every arg proxy until destruction, where before they were freed right away. is it a conscious trade off ?

[iliaal]

Conscious, yes. The return-value proxies already lived in node_list for the object's lifetime (the callback_retval insert just above this one), so this gives the argument proxies the same treatment rather than a new lifetime model.

I deliberately avoided flushing per query/evaluate: a php:function callback can re-enter with another query()/evaluate() on the same object, and the nested call shares this node_list. Flushing at the end of an evaluation would free the outer call's still-live arg proxies and bring the use-after-free right back. XSLT cleans only at the top of the transform for the same reason. The proxies are thin wrappers, released on object destruction.