[GIT-PULLS] [php-src] PR #23380: Fix GH-23377: Buffer overflow in hash_pbkdf2() with a large output length

Pull Request: https://github.com/php/php-src/pull/23380
Author: lazerg

`hash_pbkdf2()` sizes the digest buffer with `ceil((float) length / 2.0)` and the block count with `ceil((float) digest_length / (float) ops->digest_size)`. A `float` carries 24 bits of mantissa, so past 2^24 the conversion rounds and both counts come out wrong: rounding up makes `zend_bin2hex()` write past the end of the return string, rounding down leaves the tail of the string uninitialized. `hash_pbkdf2('md5', 'password', 'salt', 1, 268435473)` writes 8 bytes out of bounds under ASAN.

Both counts are exact in integer arithmetic, so this replaces them with round-up divisions. `<math.h>` had no other user in the file.

The odd `length` case from the report is in bounds on its own: `zend_string_alloc(length)` reserves `length + 1` bytes and `2 * ceil(length / 2) == length + 1`, so the last hexit lands on the terminator byte that gets overwritten on the next line.

Fixes #23377