fix: Catch ValueError from hex2bin() in Security::derandomize() on PHP 8

[gr8man]

Description
This PR fixes an issue where providing a malformed CSRF token crashes the application on newer PHP versions (particularly PHP 8.4+) instead of gracefully rejecting it.

Inside Security::derandomize(), the hex2bin() function is used to decode the randomized token. If the provided hex string is invalid (e.g., contains non-hexadecimal characters or has an odd length), older PHP versions emitted an E_WARNING which the framework's error handler converted to an ErrorException.

However, in newer PHP 8 releases, hex2bin() natively throws a ValueError for invalid input strings. Because the try/catch block was only capturing ErrorException, the ValueError escaped unhandled, resulting in a fatal crash.

Changes:

• Updated the try/catch block in Security::derandomize() to catch ValueError alongside ErrorException.
• Added testDerandomizeThrowsInvalidArgumentExceptionOnInvalidHex() to the test suite, which intentionally passes a strictly invalid hexadecimal string to verify that the InvalidArgumentException is correctly re-thrown without a fatal error.

Checklist:

• Securely signed commits
• Component(s) with PHPdoc fully completed
• Unit testing, with >80% coverage
• User guide updated (if applicable)