CVE-2024-3096 PHP function password_verify can erroneously return true when argument contains NUL