Fix use-after-free for Array#<=>

[dearblue]

The mrb_ary_cmp() function calls mrb_cmp() for comparison, but mrb_cmp() may call the obj.<=> method internally.
If a user-defined <=> method is called and the array object under comparison is expanded or reduced, a reference to an invalid address may subsequently be made.

---

% bin/mruby -e 'class C; def <=>(other); $array.clear; 0; end; end; $array = Array.new(5) { C.new };  $array <=> $array.dup'
zsh: segmentation fault (core dumped)  ../bin/mruby -e