[php-src] PR #23495: [sysvshm] Clamp shm_get_var chunk length to segment bounds

Pull Request: https://github.com/php/php-src/pull/23495 Author: iliaal shm_get_var() passed the segment-controlled sysvshm_chunk->length to php_var_unserialize() as the end bound, so a hostile segment claiming a multi-gigabyte length walks the parser past ptr->end and off the mapping. Out-of-range lengths now draw the existing corruption warning, and php_check_shm_data() skips chunk headers that do not fully fit before ptr->end. Siblings are unaffected: php_remove_shm_data() memmoves only when memcpy_len > 0, and sysvmsg unserializes msgrcv()'s kernel-bounded byte count. The regression test builds the hostile segment in-process via FFI and skips on non-Linux and on 32-bit.