Avoid race condition in Regexp#match

	In certain conditions, Regexp#match could return a MatchData with
	missing captures.  This seems to require at the least, multiple
	threads calling a method that calls the same block/proc/lambda
	which calls Regexp#match.

	The race condition happens because the MatchData is passed from
	indirectly via the backref, and other threads can modify the
	backref.

	Fix the issue by:

	1. Not reusing the existing MatchData from the backref, and always
	   allocating a new MatchData.
	2. Passing the MatchData directly to the caller using a VALUE*,
	   instead of indirectly through the backref.

	It's likely that variants of this issue exist for other Regexp
	methods.  Anywhere that MatchData is passed implicitly through
	the backref is probably vulnerable to this issue.

	Fixes [Bug #17507]
	---
	 re.c                     | 46 +++++++++++++++++++---------------------------
	 test/ruby/test_regexp.rb | 21 +++++++++++++++++++++
	 2 files changed, 40 insertions(+), 27 deletions(-)