Possible fix for convertIdToFollyDynamic crash

Summary:
The crash in T90602856 is very similar to one fixed by D22488854 (see discussion [in PR](microsoft#489 (comment))), and it's possible this `replacement` string also suffers from sharing the same backing store as the attributed string (maybe only when the range encompasses the entire string?) and therefore should be copied as well.

It's low risk, and hopefully we find it eliminates this crash, in which case I'll upstream into core.

Test Plan: Smoke tested Zeratul

Reviewers: lyahdav, mowang

Reviewed By: lyahdav

Subscribers: eliwhite

Differential Revision: https://phabricator.intern.facebook.com/D28885871

Tasks: T90602856

Signature: 28885871:1622762608:ea6a17208d585ebd6b0668135be47ae914c19a45

Libraries/Text/TextInput/RCTBaseTextInputView.m

@@ -526,7 +526,7 @@ - (void)textInputDidChange
   NSRange predictionRange;
   if (findMismatch(backedTextInputView.attributedText.string, [self predictedText], &currentRange, &predictionRange)) { // TODO(OSS Candidate ISS#2710739)
     NSString *replacement = [backedTextInputView.attributedText.string substringWithRange:currentRange];
-    [self textInputShouldChangeText:replacement inRange:predictionRange];
+    [self textInputShouldChangeText:[replacement copy] inRange:predictionRange]; // [TODO(macOS Candidate ISS#2710739)
     // JS will assume the selection changed based on the location of our shouldChangeTextInRange, so reset it.
     [self textInputDidChangeSelection];
     [self setPredictedText:backedTextInputView.attributedText.string]; // TODO(OSS Candidate ISS#2710739)