Reject classes that refuse serialization whatever methods they declare

[nicolas-grekas]

serialize() and unserialize() refuse the classes PHP flags as not serializable, subclasses included, whatever methods they declare. deepclone_to_array() let such subclasses through when they declared __wakeup() or __unserialize(), while the polyfill let through the ones declaring __sleep() or __serialize():

class MyFileInfo extends SplFileInfo
{
    public function __wakeup(): void {}
}

deepclone_to_array(new MyFileInfo(__FILE__)); // now throws NotInstantiableException

deepclone_from_array() didn't check these classes at all: a payload could create a Closure or a Generator that crashed on first use. It now rejects them like unserialize() does, and deepclone_hydrate() rejects the user classes among them, like it does for internal ones.

Anonymous classes are flagged too, but they keep round-tripping when they declare __wakeup() or __unserialize(), throwables included: VarExporter's tests rely on it. The polyfill gets the same rules in symfony/polyfill#699.