ext/curl: Deprecate the NTLM_WB constants

[GrahamCampbell]

libcurl removed NTLM_WB support in 8.8.0, so on any current libcurl the CURLAUTH_NTLM_WB bit is silently filtered out of CURLOPT_HTTPAUTH/CURLOPT_PROXYAUTH masks and the CURL_VERSION_NTLM_WB feature bit is never set; only builds against libcurl older than 8.8.0 can still use the feature at all.

This deprecates both constants with #[\Deprecated], following the CURLOPT_BINARYTRANSFER precedent from PHP 8.4, so code still referencing NTLM_WB is nudged to drop it. The NTLMWB key in curl_version()['feature_list'] is kept and continues to report false at runtime. This is also a first step in preparing for curl's scheduled removal of NTLM support altogether in September 2026 (https://curl.se/dev/deprecate.html); the still-functional CURLAUTH_NTLM and CURL_VERSION_NTLM constants are intentionally left alone.

[devnexen]

to note.

[GrahamCampbell]

Thanks for triage. Yep, I'm aware the minimum cURL version is 7.61.0, and this is only deprecating and not removing at this point. NTLM as an auth standard is also deprecated by Microsoft and has known bugs in the cURL implementation that will never be fixed, because they plan to remove it rather than spend the time making it perfect. I'd also plan to send a PR targetting PHP 8.7 to deprecate the remaining constants. Given that this requires an RFC, maybe the better thing to do would be to target PHP 8.7 with the whole bucket, instead of splitting?