fix: harden php prototype pollution sinks

[kvz]

Summary

• harden php/var/unserialize against __proto__ / constructor / prototype key injection
• harden php/strings/parse_str by skipping dangerous key paths at assignment time instead of relying on regex-prototype guards
• add focused regression coverage for both sinks

Context

This is the code-level follow-up for the remaining prototype-pollution security triage cluster:

• GHSA-4mph-v827-f877
• GHSA-vc8f-x9pp-wf5p

Validation

• corepack yarn exec vitest run test/custom/parse_str-prototype-pollution.vitest.ts test/custom/unserialize-prototype-pollution.vitest.ts
• corepack yarn exec vitest run test/generated/php/strings/parse_str.vitest.ts test/generated/php/var/unserialize.vitest.ts
• direct tsx repro scripts for both parse_str and unserialize
• git diff --check
• corepack yarn check reached the usual silent tail after all visible subchecks were green

Notes

• parse_str and unserialize are currently not in the executable parity target set, so test:parity reports them as unverified rather than runnable parity cases.
• council-review was started and did not produce a concrete finding before entering its usual long multi-agent tail, so I did not block the PR on that tooling latency.