Document and test sandbox __call support

[fabpot]

Related to #1950

[upsun-dispatch]

📋 PR Summary

This PR documents how the Twig sandbox handles attribute access that resolves through PHP's magic __call() method and adds tests covering the allowed, unallowed, method-syntax, and __call-literal cases. It touches only documentation (doc/sandbox.rst) and tests (tests/Extension/SandboxTest.php), with no production code changes.

Changes

Layer / File(s)	Summary
documentation
doc/sandbox.rst	Adds a note explaining that the sandbox checks the virtual method name written in the template (not __call) when an attribute resolves through __call(), and that allow-listing __call itself has no effect.
tests
tests/Extension/SandboxTest.php	Adds five tests and a MagicCallObject fixture covering sandbox behavior for __call()-routed virtual methods: allowed, unallowed (property and method syntax), the __call literal not granting access, and the property→__call fallback.

[upsun-dispatch]

📋 Upsun Dispatch Review: full · 2 files reviewed · no issues found

Review details

Commit: Commit 7c50819
Model: claude-opus-4-8
Panel: none

[upsun-dispatch]

📋 Upsun Dispatch Review: full · 2 files reviewed · no issues found

Review details

Commit: Commit b38efa1
Model: claude-opus-4-8
Panel: none

[upsun-dispatch]

📋 Upsun Dispatch Review: full · 2 files reviewed · no issues found

Review details

Commit: Commit b2471fd
Model: claude-opus-4-8
Panel: none

[upsun-dispatch]

📋 Upsun Dispatch Review: full · 2 files reviewed · no issues found

Review details

Commit: Commit 764ce45
Model: claude-opus-4-8
Panel: none

[upsun-dispatch]

📋 Upsun Dispatch Review: full · 2 files reviewed · no issues found

Review details

Commit: Commit 65b93f2
Model: claude-opus-4-8
Panel: none

[upsun-dispatch]

📋 Upsun Dispatch Review: incremental · 2 files reviewed · no new issues

Review details

Commit: Commits 65b93f2..29b66fd
Model: claude-opus-4-8
Panel: none