gh-157217: Fix dir() race when merging from a mappingproxy

[KingLizard1020]

dir(), dict(vars(cls)), and {**vars(cls)} go through dict_merge() on a mappingproxy of the class dict. The generic merge path called PyMapping_Keys() without holding the wrapped dict's critical section. On the free-threaded build, a concurrent insert (for example the first access to __annotations__, which stores __annotations_cache__) raised RuntimeError: dictionary changed size during iteration.

Unwrap types.MappingProxyType when it wraps a dict so the locked dict-to-dict path is used. Py_BEGIN_CRITICAL_SECTION2 already treats a self-merge (a == source) as a single mutex.

Tests:

• Lib/test/test_dict_mappingproxy.py for dict(), {**view}, and update from a mappingproxy (including a UserDict wrap, which still uses the generic path)
• test_dir_racing_class_dict_insert in Lib/test/test_free_threading/test_type.py (free-threaded only). This failed with many RuntimeErrors without the C change and passed with it.

Fixes #157217

• Issue: dir() can raise RuntimeError: dictionary changed size during iteration on the free-threaded build #157217

[hugovk]

@KingLizard1020 Please don't force push PRs. We squash merge at the end, and it's easier to review without force pushes. Also force pushes can end up spamming all the CODEOWNERS.

https://devguide.python.org/getting-started/pull-request-lifecycle/#don-t-force-push

Also please don't use things like .github/workflows/squash-once.yml to squash for you:
https://github.com/python/cpython/compare/a3a6cf9ec255be5f6a5a744aaf4517d9d2c90177..c0381c5d982b8c2f6bb55d63923a999a7d588d5b

It's confusing to see GitHub Actions force push, and also it requested reviews from 6 people in CODEOWNERs for GHA files.

Same applies to #157691. Thanks!