[GIT-PULLS] [php-src] PR #22925: ext/session: reject cookie separators in cookie_path and cookie_domain

Pull Request: https://github.com/php/php-src/pull/22925
Author: iliaal

`php_session_send_cookie()` appends `session.cookie_path` and `session.cookie_domain` to the Set-Cookie header verbatim, and neither setting rejects the characters that terminate a cookie attribute, so an application can append its own Domain, Path, HttpOnly, Secure or SameSite. `session_set_cookie_params(['path' => '/; Domain=evil.example'])` emits `Set-Cookie: PHPSESSID=<id>; path=/; Domain=evil.example`.

This applies the byte set `setcookie()` already enforces on its $path and $domain options, and does it in the ini handler so that both session_set_cookie_params() and a direct ini_set() are covered. Master only, since it starts rejecting configuration that is accepted today.