Merge branch '3.x' into 4.x

* 3.x:
  Skip the sandbox `__toString` check on arguments whose PHP parameter type cannot implicitly coerce to string
  Fix  CS
  Bump version
  Prepare the 3.27.1 release
  Fix inconsistent array access with a Stringable key
  Preserve IteratorAggregate identity in sandbox __toString walker
  Fix tests
  Bump version
  Prepare the 3.27.0 release
  Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders
  Document new support for any expression as a dynamic mapping key
  Fix sandbox __toString policy bypass via dynamic mapping keys
  Fix deprecation notices in tests
  Guard sandbox `__toString` walker against self-referencing iterables
  Fix sandbox `__toString` bypass via `Stringable` + `Traversable` containers
  Fix sandbox `__toString` bypass via the `in` and `not in` operators
  Fix sandbox __toString bypass via Traversable in join/replace filters
  Mark new SourcePolicyInterface column filter tests as @group legacy
  Fix sandbox bypass in the "column" filter under SourcePolicyInterface
  Fix sandbox bypass in deprecated internal wrappers

# Conflicts:
#	CHANGELOG
#	src/Environment.php
#	src/Node/Expression/ArrayExpression.php
#	src/Node/Expression/CallExpression.php
#	src/Resources/core.php
#	src/Template.php
#	src/Util/CallableArgumentsExtractor.php
#	src/Util/ReflectionCallable.php
#	tests/Extension/SandboxTest.php
#	tests/Resources/LegacyCoreTest.php
#	tests/TemplateTest.php

src/Util/ReflectionCallable.php

@@ -25,7 +25,7 @@ final class ReflectionCallable
     private string $name;
 
     public function __construct(
-        TwigCallableInterface $twigCallable,
+        private TwigCallableInterface $twigCallable,
     ) {
         $callable = $twigCallable->getCallable();
         if (\is_string($callable) && false !== $pos = strpos($callable, '::')) {
@@ -77,6 +77,41 @@ final class ReflectionCallable
         return $this->reflector;
     }
 
+    /**
+     * Returns the PHP parameters that map to the callable's template-level
+     * arguments.
+     *
+     * The parameters Twig injects automatically (the piped input value when
+     * $stripInput is true, then needs_charset/environment/context/is_sandboxed)
+     * and the bound arguments are stripped.
+     *
+     * @return list<\ReflectionParameter>
+     */
+    public function getTwigParameters(bool $stripInput = false): array
+    {
+        $parameters = $this->reflector->getParameters();
+        if ($stripInput) {
+            array_shift($parameters);
+        }
+        if ($this->twigCallable->needsCharset()) {
+            array_shift($parameters);
+        }
+        if ($this->twigCallable->needsEnvironment()) {
+            array_shift($parameters);
+        }
+        if ($this->twigCallable->needsContext()) {
+            array_shift($parameters);
+        }
+        if ($this->twigCallable->needsIsSandboxed()) {
+            array_shift($parameters);
+        }
+        foreach ($this->twigCallable->getArguments() as $argument) {
+            array_shift($parameters);
+        }
+
+        return array_values($parameters);
+    }
+
     public function getCallable(): \Closure|string|array
     {
         return $this->callable;