Fix 418ea8b94e SEGV on spilled ovpg

Don't spill an ovpg that is referenced in a cursor

libraries/liblmdb/mdb.c

@@ -2298,6 +2298,9 @@ mdb_pages_xkeep(MDB_cursor *mc, unsigned pflags, int all)
 					  if (IS_DIRTY_NW(txn, mp))
 						mp->mp_flags ^= P_KEEP;
 				}
+				if (MC_OVPG(m3) && ((MC_OVPG(m3)->mp_flags & Mask) == pflags) &&
+					IS_DIRTY_NW(txn, MC_OVPG(m3)))
+					MC_OVPG(m3)->mp_flags ^= P_KEEP;
 				mx = m3->mc_xcursor;
 				/* Proceed to mx if it is at a sub-database */
 				if (! (mx && (mx->mx_cursor.mc_flags & C_INITIALIZED)))