[9.x] Prevent double sanitized key in RateLimiter@tooManyAttempts

[HanakJakub]

Issue with RateLimiter with key containing '.

// Key with apostrophe
$key = "john'doe";

$rateLimiter->hit($key);

$rateLimiter->tooManyAttempts($key, 1); // false 

Calling $rateLimiter->hit($key) with key like john'doe. Will use $this->cleanRateLimiterKey($key) inside RateLimiter, which is john'doe.

Then $rateLimiter->tooManyAttempts($key, 1) was calling $key = $this->cleanRateLimiterKey($key) and then passing cleaned key to the $rateLimiter->attempts($key) which cleaned the key again and returned johna#039;doe.

So it was changing the key from john'doe to johna#039;doe. & to a

[taylorotwell]

Tests seem to be failing on PHP 8?

[taylorotwell]

Please mark as ready for review once the tests as passing.

[HanakJakub]

Issue was probably only in PHP8.1. htmlentities function default of flags parameter was changed and single quotes are now processed too.
https://php.watch/versions/8.1/html-entity-default-value-changes

- htmlentities($string, ENT_COMPAT);
+ htmlentities($string, ENT_QUOTES | ENT_SUBSTITUTE);