Fix two bugs in stg_ap_0_fast in profiling runtime

This includes two bug fixes in profiling version of stg_ap_0_fast:

• PAPs allocated by stg_ap_0_fast are now correctly tagged. This invariant is checked in Sanity.c:checkPAP.

  (This was originally implemented in 2693eb11, later reverted with ab55b4dd because it revealed the bug below, but it wasn't clear at the time whether the bug was the one below or something in the commit)

• The local variable untaggedfun is now marked as a pointer so it survives GC.

With this we finally fix all known bugs caught in #15508 (closed). concprog001 now works reliably with prof+threaded and prof runtimes (with and without -debug).