security: add allowed_classes => false to Core::safeUnserialize() as defence-in-depth

Core::safeUnserialize() validates the serialized string with a custom parser
before calling unserialize(). The parser only permits scalar types (s, b, i,
d, N) and plain arrays (a), blocking object tokens ('O:' / 'C:'). However,
the final unserialize() call does not pass allowed_classes, which means a
parser bypass or edge-case in the manual tokeniser could still allow object
instantiation.

Adding allowed_classes => false ensures that even if the manual validator is
somehow bypassed (e.g., by a future PHP serialization format change or a
subtle parser bug), unserialize() itself will refuse to instantiate PHP
objects — providing a second layer of protection.

Signed-off-by: El Mehdi Abenhazou <mehdiananas007@gmail.com>

src/Core.php

@@ -640,7 +640,11 @@ class Core
             return null;
         }
 
-        return unserialize($data);
+        // The manual parser above only permits scalars and plain arrays (s/b/i/d/N/a);
+        // any object token ('O:'/'C:') causes an early return null. Explicitly passing
+        // allowed_classes => false here adds defence-in-depth in case of parser edge
+        // cases and makes the intent clear to static analysis tools.
+        return unserialize($data, ['allowed_classes' => false]);
     }
 
     /**