ext/standard: reject control characters in the from address

[iliaal]

The ftp and http wrappers both build protocol data out of FG(from_address) without the control-character check they already apply to a URL-supplied password (ftp_fopen_wrapper.c:243, :260). A from address carrying CRLF injects a command into the FTP control channel after PASS, and a header into the HTTP request after From:

ini_set('from', "evil@example.com\r\nX-Injected: yes");
file_get_contents('http://example.com/');
// From: evil@example.com
// X-Injected: yes          <- injected

Both sinks now validate. The ftp wrapper fails the connection the way it already does for a bad URL password; the http wrapper drops the optional From header and warns, matching how it handles a User-agent it cannot construct.

Framing: from is PHP_INI_ALL, so setting it needs php.ini/.htaccess or ini_set(), and either already grants more than the injection buys. This is consistency with the checks at :243 and :260, not a trust boundary. user_agent sits at the same INI level and reaches the same request builder unvalidated, so it has the same shape.

[iliaal]

Superseded. The HTTP From: half of this duplicates phpGH-17976 (php#21658, merged to master 2026-06-24), which fixed from and user_agent together via a shared header-emit helper, and this only covered from, so it would have diverged from master on the forward-merge.

The FTP PASS half was the part that was genuinely missing (21658 deferred FTP/SOAP): php#22770, on master, reusing the existing PHP_FTP_CNTRL_CHK macro.