Add type validation for security_policy property.

[reomin]

Context

This PR fixes some issues where SecurityPolicy checks are silently skipped when the internal security_policy property is overwritten with a non-object value.

Currently, several SecurityPolicy enforcement paths rely on isset() and is_object() checks. If security_policy is set but is not an object, these checks are bypassed without any error, even when enableSecurity() has been called.

This PR makes the behavior more robust and consistent with the intended design of SecurityPolicy by enforcing stricter type handling.

Changes

• Changed security_policy from public to private
• Added getSecurityPolicy() and setSecurityPolicy() methods
• Added __set() method to validate type on assignment
• Updated all internal code to use getter/setter instead of direct property access
• Updated tests to use getSecurityPolicy()