[GIT-PULLS] [php-src] PR #22770: ext/standard: check the from address for control characters before PASS

Pull Request: https://github.com/php/php-src/pull/22770
Author: iliaal

GH-17976 sanitized `from` and `user_agent` at the HTTP wrapper's header-emit point and deferred the FTP wrapper. `php_ftp_fopen_connect()` still sends `FG(from_address)` as the anonymous password unchecked, so with `ini_set('from', "evil\r\nSITE INJECT")` the server receives a literal SITE INJECT on the control channel. The URL-supplied-password branch a few lines above already calls PHP_FTP_CNTRL_CHK; this uses the same macro over ZSTR_LEN, so the two branches now read identically.