[php-src] PR #23778: ext/openssl: scrub symmetric key material before freeing

Pull Request: https://github.com/php/php-src/pull/23778 Author: jvoisin When the supplied key is shorter than the cipher's key length, php_openssl_cipher_init() allocates a heap buffer, copies the key into it and zero-pads it to the required length. openssl_encrypt() and openssl_decrypt() then efree() this buffer without wiping it, leaving the raw symmetric key in a reclaimed heap chunk where it can later be exposed through an uninitialized-heap read, a core dump or /proc. Scrub the buffer with ZEND_SECURE_ZERO() before freeing it, matching what ext/hash, ext/standard/crypt* and ext/sodium already do for key material. At the free site password_len has already been set to the full allocation size, so the whole buffer is cleared.