Language: hide SensitiveParameterValue from json_encode/var_export (#23042)

[PurHur]

Summary

• Make SensitiveParameterValue::$value private readonly (Zend zend_exceptions.stub.php) so json_encode emits {}.
• Return an empty property bag for var_export (get_properties_for VAR_EXPORT parity) and empty (array) cast.
• Mark the class final/internal; JIT property visibility private to match.

Closes #23042

Gate snapshot (pillar 1)

Gate	Status
bootstrap-inventory --check	OK 6531/6531
release-readiness --json	user_release_ready: yes
north-star5-verify --fast	ok (via release-readiness)

Test plan

• php bin/vm.php test/repro/sensitive_parameter_value_json_var_export.php → json={} / empty __set_state / getvalue=secret
• php bin/jit.php test/repro/sensitive_parameter_value_json_var_export.php → same
• vendor/bin/phpunit --filter SensitiveParameter → OK 27 tests

Verification

$ php bin/vm.php test/repro/sensitive_parameter_value_json_var_export.php
json={}
var_export=\SensitiveParameterValue::__set_state(array( ))
getvalue=secret
vardump_has_secret=no
export_has_secret=no

$ php bin/jit.php test/repro/sensitive_parameter_value_json_var_export.php
# same

$ vendor/bin/phpunit --filter SensitiveParameter
OK (27 tests, 33 assertions)

php-src ref: Zend/zend_exceptions.c / SensitiveParameterValue — export/json must not expose backing store.
PHP impl: lib/VM/SensitiveParamSupport.php, lib/VM.php var_export bag, lib/VM/CastSupport.php.

Made with Cursor