GHSA-pr2w-4gpj-cpq4: Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points

Twig's sandbox (a security feature that restricts what templates can do) had multiple vulnerabilities where certain language constructs could bypass security checks and call `__toString()` methods (special functions that convert objects to strings) on objects without permission. Attackers could exploit this through conditional expressions, comparison operators, tests, and several other Twig features to access object data that should have been blocked.