[php-src] PR #24020: standard: Create incomplete objects again from the `C` format

Pull Request: https://github.com/php/php-src/pull/24020 Author: nicolas-grekas Since #22058 (GH-22046), unserialize() returns false as a whole when a payload holds a C: object of a class that is missing or not in allowed_classes: that class is replaced by __PHP_Incomplete_Class, which has no unserializer either. Up to 8.5, an empty incomplete object carrying the class name came back and the rest of the payload was decoded, so allowed_classes can't be used anymore to read such payloads. This happens in practice when a class that implemented Serializable is removed, see #18128. ```php final class Kept { public $a = 1; } var_dump(unserialize('a:2:{i:0;O:4:"Kept":1:{s:1:"a";i:2;}i:1;C:5:"Nope1":4:{abcd}}', ['allowed_classes' => ['Kept']])); ``` The incomplete class has no internal state, so creating an empty one is safe, and it's what the O: format already does for it. Real classes that have no unserializer keep failing, as #22058 intended.