regcomp.c: Don’t point mother_re to regexp copy

In code like this:

    $x = ${qr//};
    $y = $x
    undef $x;

We end up with $y’s mother_re pointer pointing to something that is
not a regexp.

This can cause thread cloning to create a new regexp with its SvPVX
pointing to the string buffer of the original regexp:

    $x = ${qr/abcd/};
    $y = $x;
    use Devel::Peek;
    Dump($y);
    $x = *3;
    use threads;
    async { Dump $y; print $y, "\n" }->join;

The dump shows that both $y’s share the same string buffer, and nei-
ther claims ownership to it.

I have not been able to make this crash or reuse the string for some-
thing else, but still this is walking a fine line.  Theoretically, it
should be possible for that string to be freed and reused in the par-
ent thread while the child thread is still using it.

Instead of pointing mother_re to the rhs of the assignment, point it
to the original re from which the rhs derives its existence.  I.e.,
copy the mother_re field.
Prune dead code in sv.c:sv_force_normal_flags

When a regexp is unregexped, a new SV (temp) is created, so it
can swap bodies with the regular expression (sv), and then temp
can be freed.

If SvLEN is 0, then a scalar does not own its string buffer.  Copied
regexps use that mechanism to share strings; only the original regexp
owns the string.

This little bit of code for handling the SvPVX field is strange:

	/* Remember that SvPVX is in the head, not the body. */
	if (SvLEN(temp)) {
	    SvLEN_set(temp, SvLEN(sv));
	    /* This signals "buffer is owned by someone else" in sv_clear,
	       which is the least effort way to stop it freeing the buffer.
	    */
	    SvLEN_set(sv, SvLEN(sv)+1);
	} else {
	    /* Their buffer is already owned by someone else. */
	    SvPVX(sv) = savepvn(SvPVX(sv), SvCUR(sv));
	    SvLEN_set(temp, SvCUR(sv)+1);
	}

Checking SvLEN(temp) is pointless if we have just created temp.  That
check is always false.  Presumably it was meant to be SvLEN(sv).  But
the original regexp scalar (i.e., not a copy) can never make it to
this function.  So SvLEN(sv) is always 0, which is why this has
not caused any problem.  The SvLEN_set inside the apodosis is also
strange.  ‘This signals "buffer is owned by someone else"’.  No it
certainly does not!  It is not setting SvLEN to 0, but definitely to
non-zero.  I can only assume this is a copy-and-paste error, which has
never caused a problem because it is unreachable.

I hereby excise this code (leaving the contents of the else).
sv.c: Drop PV when assigning over regexp

    $x = ${qr//};
    $x = 3;

On the second line, we don’t need to copy the stringification of the
regexp, since we are just going to clobber it anyway.
Turn off OK flags when creating a regexp.

$ perl5.16.0 -le '$x = 1.1; $x = ${qr//}; print 0+$x'
4.15336878055219e-317
$ perl5.16.0 -le '$x = 1; $x = ${qr//}; print 0+$x'
1645024

Very strange.

Under debugging builds, both produce assertion failures.

By turning off all OK flags, we also prevent the destination’s utf8-
ness from sticking.
regcomp.c: Really stop regexp-to-pv assignment from leaking

edd9fea2b8 was not enough.  A scalar may hold a PV even with the
SvPOKp flag off:

$ ./perl -Ilib -e 'warn $$; while(1){ $x = "a"; $x = 1; $x = ${qr//}}'
Allow regexp-to-pvlv assignment

Since the xpvlv and regexp structs conflict, we have to find somewhere
else to put the regexp struct.

I was going to sneak it in SvPVX, allocating a buffer large
enough to fit the regexp struct followed by the string, and have
SvPVX - sizeof(regexp) point to the struct.  But that would make all
regexp flag-checking macros fatter, and those are used in hot code.

So I came up with another method.  Regexp stringification is not
speed-critical.  So we can move the regexp stringification out of
re->sv_u and put it in the regexp struct.  Then the regexp struct
itself can be pointed to by re->sv_u.  So SVt_REGEXPs will have
re->sv_any and re->sv_u pointing to the same spot.  PVLVs can then
have sv->sv_any point to the xpvlv body as usual, but have sv->sv_u
point to a regexp struct.  All regexp member access can go through
sv_u instead of sv_any, which will be no slower than before.

Regular expressions will no longer be SvPOK, so we give sv_2pv spec-
ial logic for regexps.  We don’t need to make the regexp struct
larger, as SvLEN is currently always 0 iff mother_re is set.  So we
can replace the SvLEN field with the pv.

SvFAKE is never used without SvPOK or SvSCREAM also set.  So we can
use that to identify regexps.