[perl #119311] Keep CvDEPTH and savestack in sync

when unwinding sub and format calls.

The comments in the added test file explain what the problem is.

The fix is to call LEAVE_SCOPE in POPSUB and POPFORMAT (to free their
lexicals) before lowering CvDEPTH.

If the context has already been popped via cxstack_ix--, then
LEAVE_SCOPE could overwrite it, so accessing cx after LEAVE_SCOPE is
unsafe.  Hence the changes to POPSUB and POPFORMAT are a bit involved.
Some callers of POPSUB do a temporary cxstack_ix++ first so they
can access cx afterwards.  Two cases needed to be changed to
work that way.