[php-src] Issue #23377: Buffer overwrite in hash_pbkdf2

Issue: https://github.com/php/php-src/issues/23377
Author: Sjord

### Description

```
digest_length = (zend_long) ceil((float) length / 2.0);
returnval = zend_string_alloc(length, 0);
zend_bin2hex(ZSTR_VAL(returnval), result, digest_length);
ZSTR_VAL(returnval)[length] = 0;
```

If length is odd, `digest_length` is just over half of `length`. `zend_bin2hex` writes two bytes for every input byte, so it writes 2 * `digest_length`, which can be greater than `length`.

Example:
- `length` = 5
- `digest_length` = 3
- `zend_bin2hex` writes 6 bytes to returnval, which has been allocated to 5 bytes.



### PHP Version

```plain
master branch

PHP 8.6.0-dev (cli) (built: Aug 19 2026 12:05:36) (NTS DEBUG)
Copyright © The PHP Group and Contributors
Zend Engine v4.6.0-dev, Copyright © Zend by Perforce
    with Zend OPcache v8.6.0-dev, Copyright ©, by Zend by Perforce
```

### Operating System

_No response_