Fix GH-17201: Dom\TokenList issues with interned string replace

If a bucket previously had a non-interned string, and is now replaced
with an interned string, then the type flags still i

Fix GH-17201: Dom\TokenList issues with interned string replace

If a bucket previously had a non-interned string, and is now replaced
with an interned string, then the type flags still incorrectly state
it's a non-interned string. This leads to the refcount being edited for
interned strings, which in turn can lead to a crash when protect_memory
is set.

Closes GH-17207.

show more ...