[Security] Unserialize $parentData, if needed, to be sure the parentD…

…ata variable is an array

Check that the $parentData is an array, if it's a string, variable is unserialized.
Useful to not break the compatibility with older version.

src/Symfony/Component/Security/Core/Authentication/Token/UsernamePasswordToken.php

@@ -99,6 +99,7 @@ public function __serialize(): array
     public function __unserialize(array $data): void
     {
         [$this->credentials, $this->providerKey, $parentData] = $data;
+        $parentData = \is_array($parentData) ? $parentData : unserialize($parentData);
         parent::__unserialize($parentData);
     }
 }