Generic/ForbiddenFunctions: bug fix for class names in attributes

Attributes cannot contain function calls and in most cases, `T_STRING`s in an attribute will be a class name, not a function name.

As things were, `T_STRING`'s in attributes which _looked_ like function calls (but in actual fact are class instantiations) would lead to false positives.

Fixed now by ignoring all code within attributes.

Includes unit test.

Author: jrfnl

src/Standards/Generic/Sniffs/PHP/ForbiddenFunctionsSniff.php

@@ -162,6 +162,11 @@ public function process(File $phpcsFile, $stackPtr)
             return;
         }
 
+        if (empty($tokens[$stackPtr]['nested_attributes']) === false) {
+            // Class instantiation in attribute, not function call.
+            return;
+        }
+
         $function = strtolower($tokens[$stackPtr]['content']);
         if ($tokens[$stackPtr]['code'] === T_NAME_FULLY_QUALIFIED) {
             $function = ltrim($function, '\\');

src/Standards/Generic/Tests/PHP/ForbiddenFunctionsUnitTest.inc

@@ -55,3 +55,6 @@ function mymodule_form_callback(SizeOf $sizeof) {
 }
 
 $size = $class?->sizeof($array);
+
+#[SizeOf(10)]
+function doSomething() {}

src/Standards/Squiz/Tests/PHP/DiscouragedFunctionsUnitTest.inc

@@ -2,4 +2,6 @@
 error_log('test');
 print_r($array);
 var_dump($array);
-?>
+
+#[Var_Dump(10)]
+function debugMe() {}