[php-src] PR #22925: ext/session: reject cookie separators in cookie_path and cookie_domain

Pull Request: https://github.com/php/php-src/pull/22925 Author: iliaal php_session_send_cookie() appends session.cookie_path and session.cookie_domain to the Set-Cookie header verbatim, and neither setting rejects the characters that terminate a cookie attribute, so an application can append its own Domain, Path, HttpOnly, Secure or SameSite. session_set_cookie_params(['path' => '/; Domain=evil.example']) emits Set-Cookie: PHPSESSID=<id>; path=/; Domain=evil.example. This applies the byte set setcookie() already enforces on its $path and $domain options, and does it in the ini handler so that both session_set_cookie_params() and a direct ini_set() are covered. Master only, since it starts rejecting configuration that is accepted today.