[SECURITY] Introduce PHP stream wrapper for phar:// protocol

This custom stream wrapper for the phar:// protocol overrides
PHP's native handling. In case Phar bundles shall be loaded from
a valid directory, the custom wrapper falls back to the native PHP
wrapper in order to invoke Phar-related actions.

In case the location is not trustworthy, an according exception
is thrown. The custom stream wrapper is registered in the beginning
of TYPO3's bootstrap class.

Truested locations are those in typo3conf/ext/* - anything else is
denied and not considered as trustworthy.

Releases: master, 8.7, 7.6
Resolves: #85385
Security-Commit: 86f79d23a2c198fb3054b1d1f9414226f955c66d
Security-Bulletin: TYPO3-CORE-SA-2018-002
Change-Id: I8c6499ca8dea31bdfc7ed9fba0b479b4a7715f4a
Reviewed-on: https://review.typo3.org/57540


Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>