GHSA-9vw2-f4vp-x7gf - PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

### Summary When PHPT tests are run with code coverage, PHPUnit 13.4.0 to 13.4.3 writes the code of each PHPT test to a directory with a fixed name below the operating system's path used for temporary files, for instance `/tmp/phpunit-phpt` on Linux, and executes it from there. PHPUnit uses this directory even when it was created by another user. On a system where the path used for temporary files is shared between users, another local user can create this directory before the developer runs PHPUnit, replace the code of a PHPT test before it is executed, and thereby execute arbitrary code with the privileges of the developer. The test still passes and the code coverage report is complete, so the attack is not visible. The impact is full code execution as the user who runs PHPUnit. The likelihood is low: the attacker needs an account on the same system and must create the directory before the developer runs PHPT tests with code coverage. macOS and Windows use per-user temporary directories by default and are not affected in their default configuration. PHPUnit 12.5 and earlier are not affected. ### Details When code coverage is collected for a PHPT test, PHPUnit writes two temporary files: a `.php` file with the code of the PHPT test (the "job" file), which the child process executes, and a `.coverage` file, to which the child process writes the code coverage data it collected. Since PHPUnit 13.4.0, these files are created in a directory with a fixed name: * [`TestCase::coverageFilesDirectory()`](https://github.com/sebastianbergmann/phpunit/blob/13.4.3/src/Runner/Phpt/TestCase.php#L132-L143) returns `sys_get_temp_dir() . '/phpunit-phpt'` * The [constructor](https://github.com/sebastianbergmann/phpunit/blob/13.4.3/src/Runner/Phpt/TestCase.php#L169-L174) names the files `phpunit_phpt_<random>.php` and `phpunit_phpt_<random>.coverage` in this directory Before a PHPT test is run with code coverage, this directory is [created using `Filesystem::createDirectory()`]