Add NULL plane checks to VP8/VP9 reference frame handlers

[kalt2212]

Commit 0a6f769 (2026-09-29) added NULL checks for the Y/U/V planes of vpx_ref_frame_t in the VP8 encoder handlers, but six sibling handlers accepting the same public struct were left unpatched:

• VP9 encoder: ctrl_set_reference, ctrl_copy_reference (vp9/vp9_cx_iface.c)
• VP9 decoder: ctrl_set_reference, ctrl_copy_reference (vp9/vp9_dx_iface.c)
• VP8 decoder: vp8_set_reference, vp8_get_reference (vp8/vp8_dx_iface.c)

Passing a vpx_ref_frame_t with NULL planes via vpx_codec_control() segfaults (SIGSEGV) in the VP9 encoder/decoder paths — verified with a PoC calling the real handlers (memcpy(dst, src=NULL, n=64) confirmed via interposer).

This applies the same 5-line check already accepted upstream for the VP8 encoder to all six handlers, returning VPX_CODEC_INVALID_PARAM instead of crashing. Rebuilt and retested: handlers now return INVALID_PARAM, exit 0.