EZC: fix ref counts in _object_and_properties_init()

In _object_and_properties_init() a.k.a. object_init_ex(), the ObjectData
was created and returned to userspace with a refcount of zero, despite
being referred to by the RefData. Also, the RefData was inappropriately
incref'd, making it unconditionally leak.

The two bugs cancelled out in a common case -- calling tvUnbox() on the
RefData caused the ObjectData to be incref'd, leaving it with the
correct refcount if you discount the leaked, unreachable RefData. Added
a test case showing a less common case which previously failed.
EZC: fix off-by-one heap overflow in test function

Detected with ASan.