gh-157217: Fix dir() race when merging from a mappingproxy

[KingLizard1020]

dir(), dict(vars(cls)), and {**vars(cls)} go through dict_merge() on a mappingproxy of the class dict. The generic merge path called PyMapping_Keys() without holding the wrapped dict's critical section. On the free-threaded build, a concurrent insert (for example the first access to __annotations__, which stores __annotations_cache__) raised RuntimeError: dictionary changed size during iteration.

Unwrap types.MappingProxyType when it wraps a dict so the locked dict-to-dict path is used. Py_BEGIN_CRITICAL_SECTION2 already treats a self-merge (a == source) as a single mutex.

Tests:

• Lib/test/test_dict_mappingproxy.py for dict(), {**view}, and update from a mappingproxy (including a UserDict wrap, which still uses the generic path)
• test_dir_racing_class_dict_insert in Lib/test/test_free_threading/test_type.py (free-threaded only). This failed with many RuntimeErrors without the C change and passed with it.

Fixes #157217

• Issue: dir() can raise RuntimeError: dictionary changed size during iteration on the free-threaded build #157217

[picnixz]

Why do you need it in the headers?

[KingLizard1020]

We don't — the helper was only used from dict_merge(). I dropped _PyDictProxy_GetMapping from the header and unwrapped the mapping locally there (Py_IS_TYPE, since mappingproxy is not a base type).