EZC: Fix copying of ProxyArray

342b1193 introduced several bugs into ProxyArray::Copy and the handling
of "copy" parameters in handlers. I did not realise that Copy() gives a
refcount of zero whereas Make() gives a refcount of 1, and so I
introduced a lot of different ways to get invalid refcounts out of EZC.

* Revert the change to ProxyArray::Copy()
* When a handler is called with copy=true, take this as an opportunity
  to deproxy the array, since the EZC layer itself has no such calls.
  Prior to 342b1193, these handlers just had assert(!copy).
* Revert the change to the first half of ProxyArray::PlusEq()
* In zBoxAndProxy(), incref the result of copy() before decrefing the
  source, to avoid releasing the ArrayData when copy() returns the same
  pointer instead of making a copy. A comment array-data.cpp advises
  that this is possible.
* Added an assert to ProxyArray::Make() which previously failed.
* Added a test case which previously failed.
@tstarling Hi. For our `clang` build, we are getting the following error:

```
hphp/runtime/base/proxy-array.cpp:66:36: error: 'm_count' is a protected member of 'HPHP::ArrayData'
  assert_refcount_realistic_nz(ad->m_count);
                                   ^
./hphp/runtime/base/array-data.h:440:24: note: can only access this member on an object of type 'HPHP::ProxyArray'
      mutable RefCount m_count;
                       ^
1 error generated.
```

I was trying some stuff with `const`, etc. But I figured I would let you sort this out since you know what the code is doing best :)