It's possible for a proxy to be released during the middle of an Invoke.
E.g. a specific case where this happened was a single-shot event sink
which, upon receiving the event it was waiting for, would immediately
call DispEventUnadvise. This removed the proxy pointing to that sink
from the connection point's list of subscribers and released the last
refcount on the proxy itself.

Therefore, all state used to complete an RPC call must be on the stack;
once NdrProxySendReceive pumps STA messages and permits reentrancy,
the proxy cannot be accessed or relied on to own anything.

Add test showing MIDL_STUB_MESSAGE::pRpcChannelBuffer owns a refcount
(to ensure it can read [out] parameters from the channel)