ext/openssl: Free prior SSL_SESSION on Openssl\Session::__unserialize

[iliaal]

Openssl\Session::__unserialize() overwrote obj->session without freeing the previous SSL_SESSION when called a second time on the same instance, leaking an SSL_SESSION. These live in OpenSSL's allocator and bypass memory_limit, so a long-running worker that hits the repeat path accumulates an unbounded leak. There's no legitimate reason to re-run __unserialize() on a live instance, so it now throws when obj->session is already populated, before any overwrite.

[ndossche]

I wonder if calling __unserialize directly like this shouldn't simply be blocked.
Could have a check at start for obj->session != NULL and then throw if it isn't NULL. I wonder if there's a legitimate use-case for calling __unserialize directly. I'd rather just shut down a footgun.

[iliaal]

Agreed, better to shut the footgun. Throwing on obj->session != NULL at the top of __unserialize() skips the overwrite entirely, so there's no SSL_SESSION leak, and since it no longer reaches the second $id write it also avoids the zend_update_property_string engine-bug leak. Switched to that and updated the test to expect the new throw, which drops the #22039 dependency.