Add create_function as a disallowed function call

[BackEndTea]

I doubt this is still used much, since it was removed in PHP 8.0
But if its present you probably want to get rid of it

[spaze]

Yeah, right, even the docs say

This function internally performs an eval() and as such has the same security issues as eval().

So yeah, that function should also be reported, thanks! Now I'm wondering if the rule for the function will ever be triggered but I'm not going to build a telemetry for that 😆

Can you please squash the two commits to one? :-)

[spaze]

Thanks!