Fix leak in LuaSandbox::setCPULimit

LuaSandbox::setCPULimit() calls convert_to_double_ex() on its argument, which
decrefs the original zval and creates a new one that is a double.
convert_to_double_ex() callers in the PHP source tree invariably use the "Z"
type character in zend_parse_parameters(), which is what LuaSandbox used to do,
but I changed it to "z" to support HHVM. With "Z", a zval** is returned, and so
convert_to_double_ex() will leave the newly-allocated zval* in the stack, which
will be decref'd on return. But with "z", the newly-allocated zval leaks, since
the pointer is only stored in a local variable, and the argument zval is
decref'd, which apparently breaks HHVM's frame cleanup.

The code is Brad's, and the commit message is Tim's. I'm just a keyboard monkey.

Bug: 65796
Authored-by: Brad Jorsch <anomie.wikipedia@gmail.com>
Change-Id: I9faaf26e514094000b2a7cd5e969b2160fb80674