Fix PHP 8.3.35 HTDATA_OFFSET and document display_errors constraint

- Correct HTDATA_OFFSET for PHP 8.3.35/bookworm from 0x690D8 to 0x700D8
  (different struct sizes shift the heap layout by 7 pages)
- Verified RCE: 8.4.26 and 8.3.35 both succeed on first attempt
- Document the display_errors=On requirement for the info leak stages
- Explain why stock PHP and stock WordPress-on-PHP are still vulnerable
  (display_errors defaults to On; WordPress ini_set runs after parsing)
- Add docker configs for display_errors=Off test containers

uaf-rce/docker/php-deoff-8m.ini

@@ -0,0 +1,5 @@
+display_errors = Off
+memory_limit = 8M
+session.upload_progress.enabled = 1
+session.upload_progress.cleanup = 1
+max_input_vars = 1000

uaf-rce/docker/php-deoff.ini

@@ -0,0 +1,5 @@
+display_errors = Off
+memory_limit = 128M
+session.upload_progress.enabled = 1
+session.upload_progress.cleanup = 1
+max_input_vars = 1000