Security: Restrict allowed classes in Sequence::getUnSerializeGraph()

Refs GHSA-2c5g-hrhg-44vg

Route Sequence::getUnSerializeGraph() through UnserializeApi::unserialize()
with the existing 'sequence_graph' type, which restricts instantiation to
the Fhaculty\Graph classes that legitimately compose a serialized sequence
graph. This closes the PHP Object Injection path that allowed arbitrary
class instantiation from the sequence.graph column, reusing the codebase's
canonical allowlisted-deserialization helper.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: AngelFQC

src/CoreBundle/Entity/Sequence.php

@@ -11,6 +11,7 @@
 use Fhaculty\Graph\Graph;
 use Gedmo\Timestampable\Traits\TimestampableEntity;
 use Stringable;
+use UnserializeApi;
 
 #[ORM\Table(name: 'sequence')]
 #[ORM\Entity(repositoryClass: SequenceRepository::class)]
@@ -82,7 +83,7 @@ public function hasGraph(): bool
      */
     public function getUnSerializeGraph()
     {
-        return unserialize($this->graph);
+        return UnserializeApi::unserialize('sequence_graph', $this->graph);
     }
 
     public function setGraphAndSerialize(Graph $graph): self