[php-src] Issue #24532: `unserialize()` teardown should reset freed var entries before running destructors

Issue: https://github.com/php/php-src/issues/24532 Author: alexandre-daubois ### Description The following code: ```php <?php class Reenter { public function __destruct() { @unserialize('a:1:{i:0;'); } } $count = 1015; $payload = 'a:' . ($count + 3) . ':{'; for ($i = 0; $i < $count; $i++) { $payload .= "i:$i;i:$i;"; } $payload .= 'i:88888;i:7;i:99999;O:7:"Reenter":0:{}i:99999;i:42;}'; @unserialize($payload); echo "done\n"; ``` Resulted in an AddressSanitizer heap-use-after-free in php_var_unserialize(). var_destroy() frees the extended var_entries chain before releasing values that may invoke destructors, but leaves last and entries.next pointing to the freed chain; as a hardening measure, the context should be reset to its embedded entries block before invoking userland code. ### PHP Version ```plain PHP 8.5.12 (cli, NTS, ASan build) ``` ### Operating System _No response_