EZC: Fix copying of ProxyArray

342b1193 introduced several bugs into ProxyArray::Copy and the handling
of "copy" parameters in handlers. I did not realise that Copy() gives a
refcount of zero whereas Make() gives a refcount of 1, and so I
introduced a lot of different ways to get invalid refcounts out of EZC.

* Revert the change to ProxyArray::Copy()
* When a handler is called with copy=true, take this as an opportunity
  to deproxy the array, since the EZC layer itself has no such calls.
  Prior to 342b1193, these handlers just had assert(!copy).
* Revert the change to the first half of ProxyArray::PlusEq()
* In zBoxAndProxy(), incref the result of copy() before decrefing the
  source, to avoid releasing the ArrayData when copy() returns the same
  pointer instead of making a copy. A comment array-data.cpp advises
  that this is possible.
* Added an assert to ProxyArray::Make() which previously failed.
* Added a test case which previously failed.
Update gdb/hhvm.py for recent ProxyArray layout change