[GIT-PULLS] [php-src] PR #23071: Honor use_strict_mode for SessionHandler without validateId

Pull Request: https://github.com/php/php-src/pull/23071
Author: iliaal

SessionHandler implements neither SessionUpdateTimestampHandlerInterface nor a validateId() method, so registering it leaves ps_validate_sid undefined and PS_VALIDATE_SID_FUNC(user) falls through to php_session_validate_sid, which returns SUCCESS for every id. With session.use_strict_mode=1 and `session_set_save_handler(new SessionHandler, true)`, an attacker-supplied id is adopted instead of regenerated. Exact SessionHandler instances now delegate validation to the module they already wrap for read, write and destroy. The check is deliberately on the exact class. A subclass can override read() and write() with its own storage while inheriting the rest, and validating those against the files module is what regressed in GH-9583.