minor symfony#9563 Add "allowed_classes" argument for unserialize() (comxd)

This PR was submitted for the master branch but it was merged into the 2.7 branch instead (closes symfony#9563).

Discussion
----------

Add "allowed_classes" argument for unserialize()

Commits
-------

14c5f04 Add "allowed_classes" argument for unserialize()

Author: xabbuh

security/entity_provider.rst

@@ -133,7 +133,7 @@ For this entry, suppose that you already have a ``User`` entity inside an
                 $this->password,
                 // see section on salt below
                 // $this->salt
-            ) = unserialize($serialized);
+            ) = unserialize($serialized, ['allowed_classes' => false]);
         }
     }