EZC: fix constness issue in zend_hash_*

Summary: Fix the issue identified by @jdelong regarding modification of array elements without proper COW handling:
* Use MArrayIter for all iteration, instead of integer positions. This allows modification of the value references.
* In ProxyArray, store the inner array inside a RefData, so that MArrayIter can find the inner array via the RefData.
* Make the RefData mutable so that it can be modified by read operations.
* Now that the RefData is mutable, reseatable() can be called on a const ProxyArray. But this is somewhat awkward when reseatable() passes through its return value -- the constness of the return value would have to match the constness of the parameter. Make it return void instead.
* Implement ZEND_HASH_APPLY_REMOVE -- trivial now that MArrayIter is used.
* Unimplement zend_hash_move_backwards_ex() on an external cursor -- MArrayIter does not implement reverse iteration.
* Add test for modification of array passed by reference
Closes #2961

Reviewed By: @ptarjan

Differential Revision: D1387901

Pulled By: @JoelMarcey