fix (de)serialization incompatibility with multiple sessions

When using named sessions (see session_name), multiple sessions are
stored in a single session file. The serialized data in these sessions
may refer to previous objects, using "r:<reference_id>".

HHVM stores these reference IDs on a session_name basis. Zend PHP
however, keeps using the same reference counter for all sessions it
encounters in a single file. This works fine when either of two systems
is being used, but this may causes session data to be read improperly or
corrupt it when sharing sessions.

This change works in several ways:
- Allow us to dynamically set start/end buffers in VariableUnserializer
  so we can keep using the unserializer while keeping m_refs.
- Implement a keepCount option in VariableSerializer that does nothing
  other than keep the existing reference count, this option is disabled
  by default.
- Move serializer/unserializer out of session iteration scope so that
  we don't lose reference information.

Additionally there is a test demonstration the issue.

Closes #2078.