Security CI: ASAN/UBSAN + CodeQL

[pronskiy]

What

Add two security-focused CI workflows:

1. ASAN + UBSAN — Builds PHP from source with AddressSanitizer and UndefinedBehaviorSanitizer, then runs the full test suite. Catches memory bugs (use-after-free, buffer overflow, fd leaks, signed overflow) at runtime.
2. CodeQL — GitHub semantic analysis with security-extended queries. Catches common C vulnerability patterns statically (every push/PR + weekly).

Trimmed from the original PR #8 — removed Cppcheck and Clang Static Analyzer (overlap with CodeQL, noisy on inherited Xdebug code).

Attack Surface Analysis

This PR is informed by a threat model of the extension. Key vectors:

Network — DBGp (TCP :9003)

Vector	Severity	Status
Unauthorized debug attach — anyone reaching :9003 gets code exec via eval	Critical	Mitigated by localhost-only default; IDE connection prompts planned (SPEC §7.2)
Malicious DBGp client — crafted XML to crash extension (buffer overflow, XXE)	High	Inherited Xdebug XML parser, not yet audited post-fork
Connection flood / DoS — exhaust FDs via connection spam	Medium	No rate limiting yet
MitM on DBGp — plaintext XML, sniffable on non-localhost	Medium	Spec recommends localhost-only

Memory Safety (C extension)

Vector	Severity	Status
Use-after-free — socket FD reuse after close	High	Fixed in PR #11 (socket = -1 after close)
FD leak — failed init does not close socket	Medium	Fixed in PR #11
Buffer overflow in DBGp parser — inherited Xdebug XML parsing	High	This PR adds ASAN + CodeQL to catch these
Stack overflow — deep recursion in variable serialization	Medium	max_depth INI limits this

Information Disclosure

Vector	Severity	Status
Variable inspection exposes secrets — eval/inspect reads env vars, passwords	Critical	By design (dev tool only, SPEC §1)
Stack traces leak paths	Low	Unavoidable for a debugger

Not Applicable (yet)

• Signal handler safety — profiler SIGPROF not implemented yet (Phase 4)
• Trigger injection — auto-connect default makes triggers irrelevant
• Network sniffing — localhost only in default config

Files

• .github/workflows/sanitizers.yml — ASAN + UBSAN on PHP 8.3, 8.4
• .github/workflows/codeql.yml — CodeQL with security-extended queries

Supersedes #8.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.