Fix GH-9186 @strict-properties can be bypassed using unserialization (#9354)

* Emit deprecation warnings when adding dynamic properties to classes during unserialization - this will become a

Fix GH-9186 @strict-properties can be bypassed using unserialization (#9354)

* Emit deprecation warnings when adding dynamic properties to classes during unserialization - this will become an Error in php 9.0.
(Adding dynamic properties in other contexts was already a deprecation warning - the use case of unserialization was overlooked)
* Throw an error when attempting to add a dynamic property to a `readonly` class when unserializing
* Add new serialization methods `__serialize`/`__unserialize` for SplFixedArray to avoid creating deprecated dynamic
properties that would then be added to the backing fixed-size array
* Don't add named dynamic/declared properties (e.g. $obj->foo) of SplFixedArray to the backing array when unserializing
* Update tests to declare properties or to expect the deprecation warning
* Add news entry

Co-authored-by: Tyson Andre <tysonandre775@hotmail.com>

show more ...

Don't use unmangled name if property not found

This restores the previous behavior for this case. We'll continue
to use the mangled name, even if it does not correspond to a
declared

Don't use unmangled name if property not found

This restores the previous behavior for this case. We'll continue
to use the mangled name, even if it does not correspond to a
declared property.

This also fixes an assertion failure for the case of property
overwrite, as the add_new was not guaranteed to be "new" previously.

Fixes oss-fuzz #31045.

show more ...