Bound decompression of the client-controlled rememberedidps cookie

# If applied, this commit will...
Add an explicit 64KB max_length bound to the gzinflate() call used to
decode the rememberedidps cookie.

# Why is this change needed?
Prior to this change, inflate() called gzinflate() with no explicit
output-size bound, which was flagged in review: a small, highly
compressible attacker-crafted cookie should never be allowed to
decompress into an unbounded buffer.

# How does it address the issue?
This change passes a 65536-byte max_length to gzinflate(), so an
oversized or maliciously compressed cookie is rejected as invalid
instead of being decompressed without limit.

# Provide links to any relevant tickets, articles or other resources
#2091

Author: kayjoosten

src/OpenConext/EngineBlock/Service/Wayf/RememberedIdpCookie.php

@@ -31,6 +31,7 @@
 final class RememberedIdpCookie
 {
     public const NAME = 'rememberedidps';
+    private const int MAX_INFLATED_BYTES = 65536;
 
     public static function isEnabledForServiceProvider(
         bool $globalRememberChoiceEnabled,
@@ -241,7 +242,7 @@ private function inflate(string $decoded): ?string
     {
         set_error_handler(static fn(): bool => true);
         try {
-            $inflated = gzinflate($decoded);
+            $inflated = gzinflate($decoded, self::MAX_INFLATED_BYTES);
         } finally {
             restore_error_handler();
         }

tests/unit/OpenConext/EngineBlock/Service/Wayf/RememberedIdpCookieTest.php

@@ -121,6 +121,14 @@ public static function invalidCookieProvider(): array
             'missing expires' => [self::rawJson('{"https://sp.example.org":{"idp":"https://idp.example.org"}}')],
             'non-integer expires' => [self::rawJson('{"https://sp.example.org":{"idp":"https://idp.example.org","expires":"1700003600"}}')],
             'extra entry key' => [self::rawJson('{"https://sp.example.org":{"idp":"https://idp.example.org","expires":1700003600,"extra":"unexpected"}}')],
+            'oversized decompressed payload exceeds the bound' => [
+                base64_encode((string) gzdeflate((string) json_encode([
+                    'https://sp.example.org' => [
+                        'idp' => 'https://idp.example.org/' . str_repeat('a', 100000),
+                        'expires' => 1700003600,
+                    ],
+                ]))),
+            ],
         ];
     }