[#15491] Fix allowEmpty value-list array support in AbstractValidator and Alpha empty-value handling

[niden]

Hello!

• Type: bug fix
• Link to issue: [BUG]: allowEmpty for form validation does not work correctly when an entity is bound #15491, [BUG]: Validation: allowEmpty false does not return false when value is empty #16200

In raising this pull request, I confirm the following:

• I have read and understood the Contributing Guidelines
• I have checked that another pull request for this purpose does not exist
• I wrote some tests for this PR
• I have updated the relevant CHANGELOG
• I have created a PR for the documentation about this change

Small description of change:

#15491 — AbstractValidator::allowEmpty() value-list array support

AbstractValidator::allowEmpty() previously treated every array value of the allowEmpty option as a per-field map (['fieldName' => true/false]). This meant that the common pattern allowEmpty => [null, ''] (a list of values that should be skipped) silently fell back to false for all field names, so validation was never skipped.

The method now checks both forms:

1. Per-field map (['fieldName' => true]) — checked first via isset $allowEmpty[$field], preserving the existing behaviour used by the Ip validator.
2. Value list ([null, '']) — falls through to a strict === loop, consistent with Validation::preChecking(), so '0' is never silently treated as empty.

Three new Forms\Form\IsValidTest tests confirm that Form::isValid() correctly uses the stored entity (from the constructor or from bind()) and that allowEmpty=[null,''] skips validation for null/empty values from a bound entity with a null property.

#16200 — Alpha silently passes empty string when allowEmpty = false

preg_match("/[^[:alpha:]]/imu", "") returns 0 (no non-alpha chars in an empty string), so Alpha incorrectly returned true for empty/null values even when allowEmpty was explicitly set to false.

Alpha::validate() now adds an explicit guard: if the cast value is an empty string and getOption("allowEmpty") === false (explicitly set, not the default), it appends a message and returns false. When allowEmpty is not set the previous behaviour is preserved.

Thanks