Security: prevent nocache-marker forgery leading to cache-poisoning RCE
A template rendered through the extends:/inheritance path produces a
top-level unifunc whose nocache_hash is never restored, so on a fresh
process that reloads the compiled file from disk it stays null. Folded
into the cache-split regex in Cached::removeNoCacheHash(), that null
yields an empty alternative "(realhash|)", letting attacker-controlled
output forge a /*%%SmartyNocache:%%*/ marker whose raw content is copied
verbatim into the generated cache file and executed as PHP on the next
include() (CWE-94).
Drop empty hashes before building the regex, and when none remain treat
the whole buffer as ordinary output so forged markers are PHP-tag
neutralized like any other content.
Adds a regression test that forges a marker from assigned data and
asserts the injected PHP never executes.