Fix SafeHandle marshalling in ref/in/out parameters (#17330)