[php-src] Issue #23043: broken session id code can cause zend_mm_heap corrupted

Issue: https://github.com/php/php-src/issues/23043
Author: lmaltsis

### Description

The following code:

```php
<?
ob_start();
class a extends SessionHandler {
    function open($d, $name): bool {
        return parent::open($d, $name);
    }
    function read($b): string {
        return "";
    }
    function create_sid(): string {
        return pathinfo(session_id())['filename'];
    }
}
$c = new a;
session_set_save_handler($c);
session_start();
session_write_close();
session_start();
```

Resulted in this output (~30% of the time):
```
zend_mm_heap corrupted
Segmentation fault (core dumped)
```

But I expected this output instead (this already happens ~70% of the time):
```
Warning: SessionHandler::write(): Session ID is too long or contains illegal characters. Only the A-Z, a-z, 0-9, "-", and "," characters are allowed in /tmp/bug.php on line 17

Warning: session_write_close(): Failed to write session data using user defined save handler. (session.save_path: , handler: a::write) in /tmp/bug.php on line 17

Warning: SessionHandler::write(): Session ID is too long or contains illegal characters. Only the A-Z, a-z, 0-9, "-", and "," characters are allowed in Unknown on line 0

Warning: session_write_close(): Failed to write session data using user defined save handler. (session.save_path: , handler: a::write) in Unknown on line 0
```

### PHP Version

```plain
PHP 8.5.9 (cli) (built: Aug  3 2026 17:04:37) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.5.9, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.9, Copyright (c), by Zend Technologies

Also triggers on newest trunk https://github.com/php/php-src/commit/588dd04
```

### Operating System

Ubuntu 24.04