ext/session: reject null bytes in session.cookie_path, session.cookie_domain, session.cache_limiter

[jorgsowa]

Reject null bytes in session.cookie_path, session.cookie_domain, session.cache_limiter.

• cookie_path / cookie_domain: When the session cookie was sent, php_session_send_cookie() built the Set-Cookie header including the raw null byte. The SAPI layer (sapi_header_op) emitted a generic E_WARNING: Header may not contain NUL bytes and returned FAILURE, but php_session_send_cookie() did not check that return value and returned SUCCESS — so the session cookie was silently dropped while session_start() still returned true.
• cache_limiter: The limiter name is looked up via strcasecmp(lim->name, ZSTR_VAL(PS(cache_limiter))), which stops at the null byte, so "nocache\0evil" would silently behave as "nocache". The null byte was effectively ignored but still accepted without complaint.

[Amirhf1]

The fix looks correct and the test coverage is solid.

One small question: the UPGRADING notes mention that session_module_name()
now does NOT throw a ValueError for null bytes. Was this a deliberate
choice to keep null-byte handling consistent across all session ini
settings (warning + reject vs exception)?