Fix reentrant object-to-primitive conversion

Fix reentrant object-to-primitive conversion

Previously, njs_value_to_primitive() retained a pointer to the caller's value
slot while valueOf(), toString(), or property getters executed user code.
Reentrant code could overwrite that slot, after which the conversion treated
the replacement primitive as the original object.

The fix is to snapshot the input value before the first observable property
lookup and use the stable copy throughout conversion.

The issue was introduced in 64dbf104 (0.3.4).

This closes #1094 issue on GitHub.