Fix a regression in binding specials.

Got two lines mixed up, where order is important.

Caught by Paul Khuong.
Fix copy-more-arg on x86 and x86-64

Parsing of non-fixed (&optional, &key and &rest) arguments used to
fail when there were more fixed arguments than slots in the stack
frame. Fix this on x86oids by copying non-fixed arguments in the
correct direction, depending on whether there are more fixed args
or stack frame slots.

This bug is more visible on x86oids since 3b98d3 (Smaller stack
frames on x86oids), but may still plague other platforms.  These
platforms still have larger initial stack frame size (8 slots), so
the issue remains as hard to trigger as it's been for more than a
decade.

Reported by Jan Moringen, and reduced by Stas Boukarev.

Also add a test, marked as failing on !x86oids.
Smaller initial stack frame size on x86oids

Now that copy-more-arg is fixed, stack frames can be initialised
at 3 slots (some raw constants in the codegen seems to depend on
each frame spanning at least that many slot).
Test for broken copy-more-arg harder

* It takes 17 fixed arguments for (threaded) PPC to fail.  Test
  for up to 33 arguments now.

* Also, add some comments to explain why SP shouldn't be set to its
  final value eagerly when the stack frame is smaller than the fixed
  arguments: accessing slots past SP is a bad idea when interrupts
  could hit and overwrite these values.  In such cases, leave SP
  pointing to the end of the source vector, and only move it back to
  the end of the destination vector after the copy loop.