HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

More info at https://symfony.com/cve-2026-46637...

Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments

More info at https://symfony.com/cve-2026-46629...