Fix GH-22857: JIT FETCH_OBJ_FUNC_ARG property-hook getter frame guard

Compile ZEND_FETCH_OBJ_FUNC_ARG inline (by-value via zend_jit_fetch_obj,
by-ref via the generic handler, unknown via a runtime
ZEND_CALL_SEND_ARG_BY_REF branch) instead of bailing out to the VM. This
keeps the hook getter frame's ENTER_BIT observable, so the JIT-compiled
SEND_FUNC_ARG does not read the argument slot before the getter runs.

Signed-off-by: coderzhao <coderzhao@tencent.com>

Author: coderzhao