[Security] Unserialize $parentData, if needed, to avoid errors

[rfaivre]

Check that the $parentData is an array. If it's a string, the variable is unserialized.
Useful to not break the compatibility with the older versions.
Bug reproduced when upgrading from 3.4 to 4.4

Q	A
Branch?	4.4
Bug fix?	yes
New feature?	no
Deprecations?	no
Tickets	Fix #36813
License	MIT
Doc PR	symfony/symfony-docs#...

[nicolas-grekas]

Should we need the same for these?

$ grep 'parent::__unserialize' * -r
Core/Tests/Authentication/Token/AbstractTokenTest.php:        parent::__unserialize($parentState);
Core/Tests/Exception/CustomUserMessageAuthenticationExceptionTest.php:        parent::__unserialize($parentData);
Core/Authentication/Token/AbstractToken.php:     *         parent::__unserialize($parentData);
Core/Authentication/Token/SwitchUserToken.php:        parent::__unserialize($parentData);
Core/Authentication/Token/PreAuthenticatedToken.php:        parent::__unserialize($parentData);
Core/Authentication/Token/RememberMeToken.php:        parent::__unserialize($parentData);
Core/Authentication/Token/UsernamePasswordToken.php:        parent::__unserialize($parentData);
Core/Authentication/Token/AnonymousToken.php:        parent::__unserialize($parentData);
Core/Exception/UsernameNotFoundException.php:        parent::__unserialize($parentData);
Core/Exception/AccountStatusException.php:        parent::__unserialize($parentData);
Core/Exception/AuthenticationException.php:     *         parent::__unserialize($parentData);
Core/Exception/CustomUserMessageAuthenticationException.php:        parent::__unserialize($parentData);
Core/Exception/CustomUserMessageAccountStatusException.php:        parent::__unserialize($parentData);
Guard/Token/PostAuthenticationGuardToken.php:        parent::__unserialize($parentData);
Http/Authenticator/Token/PostAuthenticationToken.php:        parent::__unserialize($parentData);

[wouterj]

Should we need the same for these?

Except for the ones ending with Test, I think we should (and the last one, or do we want to have compatibility from 3.4 to 5.1?)

[rfaivre]

I did the changes except for Test classes

[nicolas-grekas]

Thank you @rfaivre.