When restoring misplaced internal functions, put them at the front of EG(function_table)

Probable bugfix for #59186

When Zend cleans up the function table after a request, it walks EG(function_table)
backwards from the end removing functions as long as it sees ZEND_USER_FUNCTION.
Once it encounters the first ZEND_INTERNAL_FUNCTION, it stops.

Under runkit, it's possible to create a user-function sandwhich which means that
ZEND_USER_FUNCTIONs can remain between requests.

This is bad.

We solve that here by always moving the Bucket to the ht's pListHead after
restoring the zend_function to EG(function_table).