Gate closures over named callables behind an allow_named_closures option

[nicolas-grekas]

A by-name closure payload (a first-class callable over a named function or method, e.g. strlen(...) or Cls::method(...)) lets deepclone_from_array() mint a Closure over any function or method of that name, with no visibility or staticness restriction and including internal functions such as system(). That is a stronger primitive than anything unserialize() exposes: the closure is the sink, so a payload that pairs it with an object whose __wakeup/__unserialize/destructor invokes a stored callback is a one-step gadget.

Both deepclone_to_array() and deepclone_from_array() gain a third parameter, bool $allow_named_closures = false, that both ends must enable. With it off (the default), deepclone_to_array() refuses to encode such a closure and deepclone_from_array() rejects any payload carrying a by-name closure marker before instantiating anything. Enable it only between ends that trust each other.

• The attribute-cache use case does not regress. First-class callables over a method of their own declaring class declared in a constant expression (e.g. #[Assert\When(self::isStrict(...))], Disable static callable in attribute as it's not cacheable symfony#63228) are now encoded as a declaration-site reference (mask LONG 1), like anonymous const-expr closures, instead of by name. They resolve only to a closure the named class itself declares and round-trip without the opt-in. Identification reuses the existing const-expr machinery: a first-class callable shares its target method's op_array, so re-evaluating the declaration site yields an equivalent closure, matched by the same pointer walk.
• What still needs the opt-in. References whose declaring class cannot be derived from the closure -- cross-class (Validators::check(...)) or global-function callables, inherited methods, internal functions, and any first-class callable created at runtime -- keep the by-name form and require allow_named_closures on both ends.
• allowed_classes is unchanged and still gates Closure for both forms; omit it and no closure resolves at all.

Tests: a new .phpt covers the const-expr routing of attribute first-class callables, the to_array/from_array refusals, cross-end enforcement, a hostile system() payload rejected by default, wholesale rejection of a by-name closure nested in an object graph, and allowed_classes interaction. The existing closure/lazy/allowed-classes tests are updated to pass the opt-in where they exercise runtime named closures.

Companion polyfill implementation: symfony/polyfill#634