Fix bug #65051: count() off by one inside unset()

nNumOfElements was incremented after the pDestructor code, so any
code in the dtor would get a wrong number of elements.

Right now the bucket deletion code is replicated in four places,
it should probably be moved off into one function (or rather,
zend_hash_apply_deleter should be used everywhere). The codes are
subtly different though in that the HANDLE_UNBLOCK_INTERRUPTIONS()
happens in different places. In particular it seems odd that in
some cases interruptions stay blocked during the destructor call.