twig/twig patches

[aembler]

This pull request updates the composer.json patches for twig/twig to version 3.11.3, adding several important security and documentation patches. These changes address multiple CVEs, improving the security of template rendering, sandboxing, and profiling in Twig. The most important changes are grouped below:

Security Fixes:

• Documented the dangers of using template_from_string() in sandboxed environments, warning that it can bypass sandbox policies and lead to untrusted code execution.
• Documented resource exhaustion caveats in the sandbox, clarifying that Twig's sandbox does not protect against CPU, memory, or time exhaustion, and advising process-level containment for untrusted templates.
• Fixed code injection vulnerabilities via template names in the use tag by escaping single quotes in compiled template names and improving error handling.
• Ensured the spaceless filter pre-escapes HTML input, preventing XSS when the filter is used with untrusted input.
• Escaped template and profile names in the HTML profiler output to prevent HTML injection and XSS in profiling tools.
• Fixed sandbox includes with preloaded templates to ensure security checks are enforced even if templates are already loaded.

Patch Management:

• Updated composer.json to include and reference all the above patches for twig/twig version 3.11.3.

[wordish]

LGTM, assume these are all copy/paste from source without modification. The inversion of logic in 2026-46638 looked particularly scary if it was an accident.

[wordish]

Double check: really invert logic?

[aembler]

Yeah, as crazy as it looks that's part of the original commit

twigphp/Twig@1a023fe