feat(deps): Upgrade phpseclib to v3

[susnux]

• For build(deps): bump phpseclib/phpseclib from 2.0.55 to 3.0.55 3rdparty#1972

Summary

Updated to v3 - needed to adjust quiet some places.
AI was just used for 3983f8a to help finding a working alternative because the old implementation was using v2 private functions which were not PHP private but just prefixed with _.
In v3 they made them really private so we have two options:

• drop our custom streams and use the streams provided by the library
• the solution implemented here using reflection to hack around the private fields...

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)

[susnux]

Problem with this:
Checker::createSignatureData does create a different signature... No idea what is happening the parameters are the same.

[joshtrichards]

Perhaps phpseclib2_compat as an intermediate step for v31+ (or at least v32+)?

https://phpseclib.com/docs/why#phpseclib2_compat

[susnux]

Any options on this solution?
Should we keep the "performance" streams with reflection or drop them completely and just use the library streams?

[nickvergessen]

Should document this change, as it breaks at least 2 shipped apps (app_api, nextcloud_announcements) by removing phpseclib 2, and integration_discourse because it ships phpseclib 3 without mozart/namespacing it

[susnux]

as it breaks at least 2 shipped apps

we can add the phpseclib_compat package to add intermediate support for those apps.

[nickvergessen]

we can add the phpseclib_compat package to add intermediate support for those apps.

Documenting it now and early should be good enough

[CarlSchwan]

I feel like having up to date security relevant dependency is more important than performance

[susnux]

@miaulalala thats the wrong comparison, simple put / get will always be faster.
But this is about streams as we need stream API. So the proper comparison would be custom streams vs phpseclib streams.

We optimize for round trips, so latency needs to be taken into account for the write stream.
With that in mind the benchmark results are different:

RTT	Size	Op	Custom	phpseclib built-in	Speedup (custom ÷ phpseclib)
~0 ms (LAN)	1 MB	write	1.84 MB/s	33.58 MB/s	0.05×
~0 ms (LAN)	1 MB	read	297.88 MB/s	29.48 MB/s	10.1×
~0 ms (LAN)	8 MB	write	1.94 MB/s	31.38 MB/s	0.06×
~0 ms (LAN)	8 MB	read	315.47 MB/s	27.30 MB/s	11.6×
~0 ms (LAN)	32 MB	write	1.90 MB/s	38.23 MB/s	0.05×
~0 ms (LAN)	32 MB	read	420.94 MB/s	37.20 MB/s	11.3×
~20 ms	1 MB	write	1.31 MB/s	0.25 MB/s	5.2×
~20 ms	1 MB	read	7.86 MB/s	0.25 MB/s	31.8×
~20 ms	8 MB	write	1.68 MB/s	0.25 MB/s	6.7×
~20 ms	8 MB	read	20.02 MB/s	0.25 MB/s	80.2×
~20 ms	32 MB	write	1.69 MB/s	0.25 MB/s	6.7×
~20 ms	32 MB	read	21.35 MB/s	0.25 MB/s	84.9×

Benchmark source: https://gist.github.com/susnux/77ccaaf3b3e7b7779d7f9725ea22eb69