[php-nextgen] Fix object query parameters given as a model, fixes #24684

[Frankisgek]

Fixes the query serialization of object-typed parameters when the value is a generated model
instance.

fix #24684

PR checklist

• Read the contribution guidelines.
• Run the following to build the project
• If your PR is targeting a particular programming language, @mention the [technical committee]
  @jebentier @dkarlovi @mandrean @jfastnacht @ybelenko @renepardon

What was wrong

ObjectSerializer::toQueryValue() prepared object-typed values with a plain (array) cast:

$value = (in_array($openApiType, ['object', 'array'], true)) ? (array)$value : $value;

Generated models keep their values in a single protected array $container, not in public
properties, so casting a model with (array) yields PHP's mangled property name
("\0*\0container") as the only key instead of the model's fields. The result was a query string
the server cannot interpret, produced silently.

Given this spec:

openapi: 3.0.3
info:
  title: deepObject query param repro
  version: 1.0.0
paths:
  /items:
    get:
      operationId: listItems
      parameters:
        - name: filter
          in: query
          style: deepObject
          explode: true
          schema:
            $ref: '#/components/schemas/Filter'
      responses:
        '200':
          description: ok
components:
  schemas:
    Filter:
      type: object
      properties:
        requirements:
          type: array
          items:
            type: integer
        status:
          type: string

and new Filter(['requirements' => [1, 2], 'status' => 'published']):

# before (url-decoded; \0 shown as <NUL>)
filter[<NUL>*<NUL>container][requirements][0]=1&filter[<NUL>*<NUL>container][requirements][1]=2&filter[<NUL>*<NUL>container][status]=published

# after
filter[requirements][0]=1&filter[requirements][1]=2&filter[status]=published

The fix

Object-typed values now go through sanitizeForSerialization(), which for anything implementing
ModelInterface walks openAPITypes(), calls the real getters and keys the result by
attributeMap() — the same mechanism already used for JSON request bodies. Query and body
serialization therefore share one code path, and this keeps working for any future model without
further special-casing. Plain arrays and scalars keep the original (array) cast, so nothing else
changes.

sanitizeForSerialization() returns an object at every level, while the $flattenArray step below
dispatches on is_array(), so the object graph is converted to arrays first via a small recursive
toArrayRecursive() helper. A shallow (array) cast is not sufficient: nested models stay objects
and later fail with Object of class stdClass could not be converted to string.

---

Summary by cubic

Fix query serialization for object and model-typed parameters when the value is a generated model. Models now serialize via getters instead of a shallow array cast, producing correct deepObject and form query strings. Fixes #24684.

• Bug Fixes
  • Treat any model value as an object (even when typed by its class) and serialize via sanitizeForSerialization() with a recursive toArrayRecursive().
  • Preserve existing behavior for arrays/scalars; only models change.
  • Tests cover model-typed and non-model params, nested models, and arrays; unify PHPUnit test paths.

^{Written for commit e89ccac. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 7 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>