[GIT-PULLS] [php-src] PR #22924: ext/session: check the created ID before validating it

Pull Request: https://github.com/php/php-src/pull/22924
Author: iliaal

`session_create_id()` hands the return value of `s_create_sid()` straight to `s_validate_sid()`. A userland `create_sid()` that throws makes ps_create_sid_user() return NULL, and ps_validate_sid_user() then reaches `ZVAL_STR_COPY()` with a NULL key.

Reproducer is a SessionHandler subclass whose create_sid() throws on its second call, with validateId() defined, then session_create_id() on an active session: SIGSEGV on 8.4, 8.5 and master. The four other s_create_sid() call sites, in php_session_initialize() and session_regenerate_id(), already test for NULL; #22580 covers the remaining one in SessionHandler::create_sid().