Introduced a weak ref for target of messages saved by a KWSpy, to avoid leaks.

Since the invocation array is owned by the spy, and the elements (NSInvocations) are retained by the array, having an invocation retain the spy (which will be the target of every message it captures) will result in a retain cycle, and the spy and all the invocations will be leaked at the end of the test.

The change here does not completely eliminate the problem, as it only replaces the target. If the spy appears as any other argument, or is part of a chain of strong references from any of the arguments, a retain cycle can still occur. I can think of no reasonable way to scan all arguments to prevent this, and it's also not workable to *not* retain the arguments, as they may be released before the invocation is later tested (although, in practice, most will probably still be in the auto-release pool, so would technically be safe). Ultimately, the invocations should be stored somewhere else to completely solve the issue.
Copy block arguments to be saved in spy messages.

The previous commit revealed an issue in how block arguments were saved. When block arguments were of the stack variety, they would often be invalid by the time the NSInvocation that pointed to them was finally released. This would cause a crash when the block was sent a "release" message itself. (Prior to the previous change, spies and their NSInvocations were never getting released, so the error never showed up.)

We now scan the arguments and make copies of any block arguments, before retaining the copy. This will not help if some argument holds a reference to a block, but any object that keeps a block reference *should* have copied it already, so this should never be a problem in practice.