php#146 flock: pin task across SUSPEND to keep inline-tail flock_data alive

ASAN: heap-use-after-free in php_stdiop_set_option at the post-SUSPEND
read of flock_data->result. flock_data is the inline tail of the libuv
task; the scheduler's WAKER_CLEAN_EVENTS runs between worker completion
and SUSPEND returning, releases the task's last ref, and libuv_task_dispose
pefree's the whole region — including flock_data — before our code wakes.

Fix: ADD_REF the task before SUSPEND, snapshot result/error_code into
locals after SUSPEND, then RELEASE. All error paths matched.

Repro: ext/async/tests/io/081-flock_non_blocking_event_loop.phpt under
LINUX_X64_DEBUG_ZTS_ASAN (PR php#149 job 77702704014). Local ASAN sweep on
ext/async/tests + ext/standard/tests/file + Zend/tests: 6795/6798 pass,
3 pre-existing unrelated fails (gh19983, 050/052 thread shutdown), no
new UAFs.

Author: EdmondDantes

main/streams/plain_wrapper.c

@@ -1244,17 +1244,26 @@ static int php_stdiop_set_option(php_stream *stream, int option, int value, void
 					return -1;
 				}
 
+				/* Pin task across SUSPEND: waker cleanup disposes it before SUSPEND returns,
+				 * freeing the inline-tail flock_data we still need to read. */
+				ZEND_ASYNC_EVENT_ADD_REF(&task->base);
+
 				if (UNEXPECTED(!ZEND_ASYNC_SUSPEND())) {
 					ZEND_ASYNC_WAKER_DESTROY(coroutine);
+					ZEND_ASYNC_EVENT_RELEASE(&task->base);
 					return -1;
 				}
 
-				if (flock_data->result == 0) {
+				const int flock_result = flock_data->result;
+				const int flock_errno = flock_data->error_code;
+				ZEND_ASYNC_EVENT_RELEASE(&task->base);
+
+				if (flock_result == 0) {
 					data->lock_flag = value;
 					return 0;
 				}
 
-				errno = flock_data->error_code;
+				errno = flock_errno;
 				return -1;
 			}