fix(security): FileDriver allowed_classes=false (v2.3.3)

[devsimsek]

Summary

Resolves the final critical security finding (SDF-59) from the deep security audit. Bumps 2.3.2 → 2.3.3.

Fix

Ticket	Surface	Fix
SDF-59	sdf/core/Cache/FileDriver.php:265	unserialize(..., ['allowed_classes' => true]) → false. Blocks object-injection RCE gadget chains (Monolog, Guzzle, etc.) - cached objects now become __PHP_Incomplete_Class (no __wakeup/__destruct fires). Brings FileDriver in line with RedisDriver and MemcachedDriver which already used false.

Breaking change

Users who cached PHP objects via FileDriver will now get null from Cache::get() instead of an object instance. Migration:

// Before (v2.3.2)
Cache::set('user', $userObject);
$user = Cache::get('user');  // User instance

// After (v2.3.3)
Cache::set('user', $userObject->toArray());
$user = Cache::get('user');  // array

Documented in wiki/libraries/caching.md - new "Object unserialization safety (v2.3.3+)" section.
Tests
1 new test: test_file_driver_refuses_object_unserialization - writes serialized stdClass directly to cache file, asserts get() returns null.
Verification

• PHPUnit: 447 tests, 786 assertions, 0 failures (1 new)
• PHPStan level 5: No errors
• PHP-CS-Fixer: 0 files need fixing
  Audit progress - all 6 critical issues resolved
• SDF-56, SDF-58, SDF-60, SDF-61 (v2.3.1 - PR fix(security): resolve 4 critical security findings (v2.3.1) #21)
• SDF-57 (v2.3.2 - previous PR)
• SDF-59 (this PR - v2.3.3)

[devsimsek]

ready for code review - (experimental, used saddle)

[devsimsek]

LGTM! let's merge.