Fix GH-15938: Hold onto the container after a get_property_ptr_ptr() call

[arnaud-lb]

Effects performed after a get_property_ptr_ptr() call may make the property pointer invalid by freeing or reallocating its container.

The container might be the object itself, the properties ht, a proxied object. For internal classes, this can be anything else.

Here we change the get_property_ptr_ptr handler so it exposes the actual container. The caller can then increase its refcount if any operation performed before the last access to the property could render the property invalid.

The get_property_ptr_ptr() implementation has the responsibility of ensuring that while the container's refcount is incremented, the property pointer remains valid.

Fixes GH-15938

cc @iluuu1994 @nielsdos

[iluuu1994]

The approach seems reasonable. It's a bit unfortunate that this API change is necessary only because of internal classes with fetch_ptr_ptr to custom storage that may also move, which should be very rare. FWIU, the properties table RC could simply always be increased along with the object RC, making that problem go away. For internal classes, maybe we could fix the issue in a different way by flagging the object for the duration of the ptr lifetime, and prevent changes being made to objects with such flags. This would require checks in multiple places, so might not be a better solution.

In any case, I don't object to this approach.

[ndossche]

This approach seems relatively simple and I can't immediately think of a problem. Will need to test more intensively coming week.