Copy PADTMPS passed to XSUBs

Copy PADTMPS passed to XSUBs

This resolves the last remaining issue in ticket #78194, that
newRV is supposedly buggy because it doesn’t copy its referent.
The full implications of the PADTMP are not explained anywhere in
the API docs, and even XSUBs shouldn’t have to worry about special
handling.  (E.g., what if they do SvREFCNT_dec(SvRV(sv)); SvRV(sv)=...?)

So the real solution here is not to let XSUBs see them.