Sandbox foreachVars in templates

Nesting the same template inside a `foreach` loop that is also accessed inside the nested call will overwrite the values from the outer template due to identical identifiers being used.

The sandbox did not protected `$this->foreachVars` despite being stateful.

See #4431
Fixes #4444

wcfsetup/install/files/lib/system/template/TemplateEngine.class.php

@@ -521,8 +521,11 @@ public function getPluginClassName($type, $tag) {
 	 * Enables execution in sandbox.
 	 */
 	public function enableSandbox() {
-		$index = count($this->sandboxVars);
-		$this->sandboxVars[$index] = $this->v;
+		$index = \count($this->sandboxVars);
+        $this->sandboxVars[$index] = [
+            'foreachVars' => $this->foreachVars,
+            'v' => $this->v,
+        ];
 	}
 
 	/**
@@ -532,8 +535,10 @@ public function disableSandbox() {
 		if (empty($this->sandboxVars)) {
 			throw new SystemException('TemplateEngine is currently not running in a sandbox.');
 		}
-
-		$this->v = array_pop($this->sandboxVars);
+
+        $values = \array_pop($this->sandboxVars);
+        $this->foreachVars = $values['foreachVars'];
+        $this->v = $values['v'];
 	}
 
 	/**