timers: use locks and pointers, not references

[gfwilliams]

ref #1444 and #2586

Waveform and the new JS interrupt feature store references to vars in jstimer (JS interrupt stores as userdata of UET_EXEC)

The problem is that now we have defrag, it can move items around because they're referenced, not locked. So in theory mid-waveform a buffer could just be shifted out the way by defrag and we end up writing to the wrong place.

So ideally we want to lock, however we can't unlock from an IRQ when a timer task is finished.

Maybe we want to:

• Add a UET_QUEUE_FREE enum which we can OR with the timer type at the time we take the timer out of the timer queue
• Post a new EV_CUSTOM event for TIMER_FREE
• Handle that event in the event and free any locked vars there (maybe we can poke waveform/stepper so they don't have to poll?)