GHSA-f6p5-76fp-m248: URL Rewrite vulnerability in multiple zendframework components

The vulnerability pattern across all components involves URI determination logic that trusted specific HTTP headers (X-Rewrite-Url, X-Original-Url) without verifying the server environment actually uses those rewrite mechanisms. The primary vulnerable functions are those responsible for marshaling request URIs in each component:

1. In zend-diactoros: ServerRequestFactory's URI creation method trusted rewrite headers
2. In zend-http: PhpEnvironment\Request's URI detection used vulnerable headers
3. In zend-feed: PubSubHubbub's Subscriber used headers to verify callback URLs

These functions would appear in runtime profiles when processing malicious requests containing spoofed rewrite headers, as they directly handle header-based URI resolution before the security patches added server environment validation checks.