Fix GH-21673: password_verify() failed to verify bcrypt passwords containing null bytes

[LamentXU123]

Now, since including \0 in password_hash is not allowed in PASSWORD_BCRYPT. It is reasonable to add checkers that, makes input that includes \0 in password_verify directly fails.

This PR align password_verify() with password_hash() for bcrypt by rejecting passwords containing NUL bytes before verification.

Because bcrypt treats passwords as NUL-terminated C strings, this avoids ambiguous verification behavior for inputs such as "foo\0bar". A regression test is included.

Fix #21673

To be short: password encrypted by BYCRYPT should never includes \0. So directly rejecting it is always correct. It also avoids ambiguous verification where something like this happens:

<?php
$hash = password_hash("secret", PASSWORD_BCRYPT);
var_dump(password_verify("secret" . chr(0) . "suffix", $hash)); //True, WTF?
?>

[devnexen]

nit: zend_str_has_nul_bytes(password)

[devnexen]

or what can be done is modifying password argument handling in password_hash/verify possibly.