fix (de)serialization incompatibility with multiple sessions

When using named sessions (see session_name), multiple sessions are
stored in a single session file. The serialized data in these sessions
may refer to previous objects, using "r:<reference_id>".

HHVM stores these reference IDs on a session_name basis. Zend PHP
however, keeps using the same reference counter for all sessions it
encounters in a single file. This works fine when either of two runtimes
is being used, but this may cause session data to be read improperly or
corrupt it when sharing a session.

This change works in several ways:
- Allow us to dynamically set start/end buffers in VariableUnserializer
  so we can keep using the unserializer while keeping m_refs.
- Implement a keepCount option in VariableSerializer that does nothing
  other than keep the existing reference count, this option is disabled
  by default.
- Move serializer/unserializer out of session iteration scope so that
  we don't lose reference information.

Additionally there is a test demonstration the issue.

Closes #2078.