Guard relied on FILTER_FLAG_GLOBAL_RANGE, which only exists from PHP
8.2. It now checks addresses against its own list taken from the IANA
IPv4 and IPv6 special-purpose registries (plus multicast), so every PHP
version refuses the same addresses. The list also covers ranges the PHP
flag let through, such as 2001:db8::/32 and 3fff::/20.

Declare php >= 7.1 (the nullable parameter type needs it), so older PHP
versions keep resolving to 0.1.x. Tests run on PHPUnit 9.6 as well.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

set_safe_mode(true) refuses anything but http and https, refuses hosts
that resolve to loopback, private, link-local or reserved addresses,
pins curl to the addresses that were checked (no DNS rebinding), and
follows redirects one hop at a time so each is checked, dropping
credentials when a redirect changes origin. Hosts or ranges can be
allowed explicitly for development servers.

Off by default. Adds a PHPUnit suite.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>