unserialize: Strictly check for :{ at object start

[TimWolla]

This change adds validation for the serialization format during object serialization: Checks where missing to verify that objects actually start with :{, because the object format is not actually part of the grammar, likely because of the classname that is not necessary for arrays.

It also fixes a case where object_custom moved *p past the string bounds. While the contents at the pointer are not read afterwards, even the creation of such a pointer is technically UB.

---

It's not clear to me what the appropriate target branch would be. I think it should go into PHP 8.2 at least.

[Girgias]

This change looks reasonable but I would like another person's opinion.

[cmb69]

Thank you! The stricter checking makes sense to me, but there should be a note in UPGRADING.

[TimWolla]

@saundefined @adoy @ramsey Is this change acceptable as-is for PHP 8.2? This PR:

• Fixes an actual bug: The previous logic might invoke undefined behavior (in the C language sense), because it creates an out-of-bounds pointer (no dereference needed to invoke UB). This fix is highlighted by the change to the ext/standard/tests/serialize/bug74111.phpt test.
• Increases strictness of the unserialization parser. This is highlighted by the newly added tests. Specifically for serialized objects the leading :{ may be replaced by any byte without changing the result.

It does not introduce a behavioral change to valid serialization data, as emitted by serialize().

Personally I would prefer to apply this as-is to PHP 8.2 which still is a fairly young branch. If including the full PR is undesired for compat purposes, then I would like to apply the first bullet point to PHP 8.2 at least and the stricter checking to master only.

[saundefined]

@TimWolla thanks!

I see no reason not to include as is in PHP-8.2, perhaps Ben and Pierrick would disagree with me.

[adoy]

@TimWolla Same as @saundefined it looks good to me. You can go ahead to merge this on 8.2

[TimWolla]

Thank you, I'll rebase this later onto PHP-8.2 to run CI again, add NEWS and UPGRADING notes and then merge.