GH-23686: SOAP: redact more headers by default, add keep_headers option

[DanielEScherzer]

No description provided.

[DanielEScherzer]

@php/release-managers-86 can you please let me know if this needs to be in by the branch cut? I'm unsure if this counts as a new feature that would be blocked by the feature freeze - it adds more options, but the motivation is to allow opting out of the bug fix

[svpernova09]

@mbeccati and I agree this can go into 8.6

[DanielEScherzer]

This should be ready for review, ideally we should merge it in the next two weeks so that it is in RC3

[DanielEScherzer]

Okay

• rebased
• ext/soap: fix leak when load_wsdl_ex() fails to load #24066 was merged, so that commit no longer needed to be cherry pick here for this branch to not have memory leaks
• fixed proxy authorization searching

hopefully should be ready for another round of review

[devnexen]

Suggested change

	zend_string_release(lc_headers);
	zend_string_release(lc_headers);
	zend_string_release(flat_headers);

[DanielEScherzer]

If I'm reading the suggestions correctly, they are to handle headers that are stored as arrays properly - but the tests suggests that they are already handled?

Looks like this is because get_sdl() uses http_context_headers() which converts things from an array to a string when filtering out known headers, and that is only triggered if soap wants to add its own headers, able to trigger the failure with:

$context = stream_context_create([
  'http' => [
    // having a protocol here means that SOAP won't add it itself
    'protocol_version' => 1.1,
    'header' => [
      "X-Authorization: This should be kept",
      "Authorization: This should be removed",
      "X-Proxy-Authorization: This should also be kept",
      "Proxy-Authorization: This should also be removed",
      "X-Cookie: Last one to keep",
      "Cookie: Last one to remove",
    ]
  ],
]);

good catch - I hadn't addressed array headers originally since on #23686 I was told that they could be ignored, but you're right that we should probably address them, done