[Kaus1ubh]

With a 16 MiB memory limit and a 200% hard limit, encoding a 12 MiB string of NUL bytes currently terminates the process with exit 137 before registered shutdown handlers run. Both urlencode() and rawurlencode() reach the non-fallible allocation path when reserving the output buffer.

This changes the PHP functions to use fallible allocation and return through RETURN_OOM() on failure. The original buffer is released if truncation fails. The exported C functions php_url_encode() and php_raw_url_encode() keep their existing allocation behavior and return contract; their callers in cookies, sessions, phpinfo and query building still assume a non-NULL result.

This addresses the two PHP functions from #24492 and complements #24548, which leaves URL encoding out of scope. Other paths using the C functions remain outside this patch.

Validation on Linux with a debug/AddressSanitizer build of PHP-8.4 (base f6852be):

• Both new OOM tests fail before the patch (exit 137, no shutdown output) and pass after it (normal fatal OOM, exit 255, shutdown output present).
• URL encoding, query building, cookie and selected session tests: 60 tests, 59 pass, 1 documented ASAN skip, 0 failures. ASAN_OPTIONS=detect_leaks=0 SKIP_ASAN=1; normal Zend allocator enabled.
• Output checks cover empty/short inputs, 15/16/17-byte prefixes, a longer prefix, NUL, spaces and escaped punctuation.

Draft for review of the limited PHP-function approach before extending the fallible contract to C callers. Windows and non-ASAN builds have not been tested locally.