Stdlib: openssl_pkcs12_read/export/export_to_file() — PKCS#12 keystore API (#6420)

[PurHur]

Summary

• Implement openssl_pkcs12_read(), openssl_pkcs12_export(), and openssl_pkcs12_export_to_file() on the VM via ext/openssl/VmOpensslPkcs12Native.php (libcrypto FFI; php-src ext/openssl/pkcs12.c).
• Wire by-ref $certificates / $output indices in BuiltinByRefParams and add compliance + maintainer round-trip guards.
• Refresh spine includes + gen-0 sidecar stamp for new ext/openssl/* inventory files.

php-src reference

• ext/openssl/pkcs12.c — PHP_FUNCTION(openssl_pkcs12_read|export|export_to_file)
• PKCS12_create(..., 0, 0, 0, 0, 0) default cipher/MAC params (OpenSSL 3 PBES2 defaults)

Test plan

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh
php bin/vm.php test/repro/maintainer_openssl_pkcs12.php
php -d memory_limit=1536M vendor/bin/phpunit --filter openssl_pkcs12_roundtrip
php -d memory_limit=1536M vendor/bin/phpunit --filter BuiltinByRefParamsTest
./script/check-generated-docs.sh
php script/check-selfhost-spine-coverage-sync.php
php script/check-selfhost-spine-sidecar-sync.php
'

Verification output (Jul 2026):

• maintainer_openssl_pkcs12.php → ok
• openssl_pkcs12_roundtrip VMTest → OK (2 tests)
• BuiltinByRefParamsTest → OK (18 tests)
• check-generated-docs.sh → all in sync
• spine coverage + sidecar sync → OK

Closes #6420

Made with Cursor

[PurHur]

Maintainer triage (2026-07-13): test plan and php-src refs look good, but GitHub reports mergeable: CONFLICTING. Please rebase onto current main (touches docs/bootstrap-inventory.md, spine sidecar, gen-0 stamp — likely conflict zone) before merge review.

Local spot-check: function_exists('openssl_pkcs12_read') is false on VM vs true on Zend in Docker — this PR should close that gap once merged.