Requesting CURL_HTTP_VERSION_2 makes curl send an h2c Upgrade request on
plain http URLs, which some servers mishandle. PHP 7.3's built-in server
drops the connection, which failed the curl tests on PHP 7.3. Use
CURL_HTTP_VERSION_2TLS instead, curl's own default since 7.62: https
still negotiates HTTP/2.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

set_safe_mode(true) refuses anything but http and https, refuses hosts
that resolve to loopback, private, link-local or reserved addresses,
pins curl to the addresses that were checked (no DNS rebinding), and
follows redirects one hop at a time so each is checked, dropping
credentials when a redirect changes origin. Hosts or ranges can be
allowed explicitly for development servers.

Off by default. Adds a PHPUnit suite.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>