[marshal] Wrap byref reference args to icalls in coop handles correctly.

[marshal] Wrap byref reference args to icalls in coop handles correctly.

Previously we only had "out" reference args working - they get a handle that's
initialized to NULL on entry and then writes back to the out arg on icall
return.

For "ref" reference args, do the same thing but initialize to the initial
argument value.