[php-src] PR #23798: ext/standard: Bound-check RR parsing in the dns_get_mx() answer loop

Pull Request: https://github.com/php/php-src/pull/23798 Author: iliaal dns_get_mx() reads type, class, ttl, rdlength and weight with raw GETSHORT() after an unvalidated dn_skipname() advance. A reply whose last record name ends at the end of the received data walks up to about 12 bytes past the 64K querybuf stack union, and the weight is handed to userland through the $weights array. php_parserr() already guards the equivalent reads with CHECKCP(10)/CHECKCP(2) and this mirrors it; rdata skips stay bounded by the cp < end loop condition. No test ships because a red one needs an LD_PRELOAD resolver mock serving a truncated reply.