Draft: combase: Fix refcount leak fix in apartment_hostobject
Demonstrate a refcount leak on the class factory when a class with ThreadingModel=Apartment is instantiated in the MTA. CoGetClassObject ends up using apartment_hostobject to launch an STA thread in which to host the object, but the process of marshaling this class factory back into the MTA leaks a reference on it.
This leak is usually minor (class factory implementations are usually singletons, so it's a one-of rather than a cumulative leak), but it will generally lock that COM server and e.g. prevent CoFreeUnusedLibraries from being able to clean up properly.
When CoMarshalInterface succeeds, it added an additional refcount represented by the marshaling data written to the stream. The original refcount returned from apartment_getclassobject needs to be released regardless of marshaling success or failure.