Add flag support for params

[spaze]

I'd like to allow params when a flag is present ia param value like JSON_HEX_TAG | JSON_HEX_APOS. Currently that's not possible and a param value is treated as scalar value.

This will need a new param format, one idea is mentioned in #141 (comment)

After adding the support, json_decode() with JSON_THROW_ON_ERROR could be added to the "loose" config as originally proposed by @ilazaridis in #141.

Also this should be updated too then

phpstan-disallowed-calls/disallowed-loose-calls.neon

Lines 9 to 12 in 332969d

	function: 'htmlspecialchars()'
	message: 'set the $flags parameter to `ENT_QUOTES` to also convert single quotes to entities to prevent some HTML injection bugs'
	allowParamsAnywhere:
	2: ::ENT_QUOTES