ext/zip: Make ZipArchive non-serializable

A ZipArchive wraps a libzip resource that cannot survive serialization,
so unserialize() silently produced a broken object (numFiles = 0) instead
of erroring. Mark the class as not-serializable, consistent with Socket,
CurlHandle and the Dba classes.

Fixes GH-21682

Author: k2gl

NEWS

@@ -266,6 +266,8 @@ PHP                                                                        NEWS
     (kocsismate)
 
 - Zip:
+  . Fixed bug GH-21682 (ZipArchive must not be serializable).
+    (Nickolay Harin)
   . Fixed ZipArchive callback being called after executor has shut down.
     (ilutov)
   . Support minimum version for libzip dependency updated to 1.0.0.

ext/zip/php_zip.stub.php

@@ -64,6 +64,9 @@ function zip_entry_filesize($zip_entry): int|false {}
 #[\Deprecated(since: '8.0', message: 'use ZipArchive::statIndex() instead')]
 function zip_entry_compressionmethod($zip_entry): string|false {}
 
+/**
+ * @not-serializable
+ */
 class ZipArchive implements Countable
 {
     /**

ext/zip/php_zip_arginfo.h

@@ -0,0 +1,14 @@
+--TEST--
+GH-21682 (ZipArchive must not be serializable)
+--EXTENSIONS--
+zip
+--FILE--
+<?php
+try {
+    serialize(new ZipArchive());
+} catch (\Exception $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+Serialization of 'ZipArchive' is not allowed