[0.4.9][WIN32SS][RTL] Fix regression CORE-16769 + BSOD 0x50 CORE-13907

[0.4.9][WIN32SS][RTL] Fix regression CORE-16769 + BSOD 0x50 CORE-13907

The main motivation to port all that back is to get rid of Win32K-BSODs 0x50 like CORE-13907
that could be triggered by user-mode-applications.
Technical reason was CORE-14857 "RtlImageNtHeaderEx needs SEH" and issues with hooks+callbacks.
All other tickets mentioned in here were regressions that we experienced on the long
journey towards perfecting the fixes on master head, and those were not happening yet in the older builds,
so they are mentioned in here only to allow tracking where that code went into.

Thanks to Jim Tabor, Mark Jansen & Thomas Faber
By squashed backmerge of the following commits:
0.4.15-dev-3440-g a89844f7408fa1eb5c81e358c27490b095a680b1
0.4.15-dev-3430-g 9cff384c222900d1f25c4beae9362c44da99a3d9
0.4.14-dev-1287-g 568b6d0558d047df1826d7438448432643d7fe5c
0.4.14-dev-1255-g 177ae91bf63810daae17f15bb21be16592c485a1
0.4.14-dev-1241-g 915a5764a98be6f8a03471d68a55e4b1a5899f66
0.4.14-dev-1240-g d8add40e893c4bbbb72211cae3e351445e53a3f4
0.4.14-dev-1002-g feb7df42b475412823b50ea8d22ec98843df6c49

JIRA-tickets: CORE-13907, CORE-16769, CORE-14857, CORE-17856, CORE-17857, partially CORE-13019.
We also had some more dupes of CORE-13907 in JIRA, but I linked all of them (transitively)
towards the initial report, and resolved them without setting a fixVer for them.

In more detail:
--------------
[USER32] Fix BSOD 0x50 in 'WineVDM + Castle Of Winds' CORE-17856 CORE-17857

CORE-17856 BSOD 0x50 when starting Castle of the Winds second time, with WineVDM
CORE-17857 BSOD 0x50 on shutdown after closing Castle of the Winds with WineVDM

0.4.15-dev-3430-g 9cff384c222900d1f25c4beae9362c44da99a3d9
0.4.15-dev-3440-g a89844f7408fa1eb5c81e358c27490b095a680b1
--------------
[NTUSER] Fix Strings and Format to Hooks

Allocate heap instead of data segment to be used for callbacks on user side.
Move and correct initial hook call out setup. Use it in more than one hook call.

This fixes issues with strings out of alignment and use of kernel pointers.

See CORE-13907 (HXD-portable BSOD) and CORE-16769 (HXD-portable exception)

Small wow update.

cherry picked from commit 0.4.14-dev-1287-g 568b6d0558d047df1826d7438448432643d7fe5c
--------------
[RTL] Introduce RtlpImageNtHeader,
which implements the required functionality.
ntdll and ntoskrnl now have a wrapper for this, with SEH.
This protects the function against malformed / bad images,
whilst still being able to use the code in freeldr et al.
Idea from Thomas.
CORE-14857

cherry picked from commit 0.4.14-dev-1255-g 177ae91bf63810daae17f15bb21be16592c485a1
--------------
[WIN32SS] Form Sanity to Hook Callbacks

Fix WH_CALLWNDPROC/RET data to user hook calls.
Helps with CORE-13907 "(HXD-portable BSOD)"
Fixes the logging of "(win32ss/user/ntuser/callback.c:748) err: Failure to make Callback! Status 0xc00000fd" within CORE-13019, but not the whole ticket.

cherry picked from commit 0.4.14-dev-1241-g 915a5764a98be6f8a03471d68a55e4b1a5899f66
--------------
[USER32] Fix null return.

See CORE-16769 "HxD 1.7.7.0 portable unhandled exception"

cherry picked from commit 0.4.14-dev-1240-g d8add40e893c4bbbb72211cae3e351445e53a3f4
--------------
[WIN32SS] Fix a typo in dbg print

cherry picked from commit 0.4.14-dev-1002-g feb7df42b475412823b50ea8d22ec98843df6c49