How to retrieve metadata from salesforce with force.com toolkit for PHP?

The PHP toolkit shipped by Salesforce is quite outdated and should not be used. There are more recent forks/community projects (one,two) that attempt to implement a modern PHP client, perhaps one of these will work for you.

A simple(r) solution is to retrieve the SecuritySettings via a plain SOAP call to the Metadata API. The request payload with API version set to 46.0 should be

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>Security</members>
        <name>Settings</name>
    </types>
    <version>46.0</version>
</Package>

and the response looks like this (only relevant portion is shown, the actual response is much larger)

<?xml version="1.0" encoding="UTF-8"?>
<SecuritySettings xmlns="http://soap.sforce.com/2006/04/metadata">
    <networkAccess>
        <ipRanges>
            <description>...</description>
            <end>1.255.255.255</end>
            <start>0.0.0.0</start>
        </ipRanges>
    </networkAccess>
</SecuritySettings>

Translating to PHP:

$wsdl = PUBLIC_PATH . '/wsdl-metadata.xml'; 
$apiVersion = 46.0;
$singlePackage = true;
$members = 'Security';
$name = 'Settings';

$params = new StdClass();
$params->retrieveRequest = new StdClass();
$params->retrieveRequest->apiVersion = $apiVersion;
$params->retrieveRequest->singlePackage = $singlePackage;
$params->retrieveRequest->unpackaged = new StdClass();
$params->retrieveRequest->unpackaged->version = $apiVersion;
$params->retrieveRequest->unpackaged->type = new stdClass();
$params->retrieveRequest->unpackaged->type->members = $members;
$params->retrieveRequest->unpackaged->type->name = $name;

$option = [
    'trace' => TRUE,
];
// Namespaces
$namespace = 'http://soap.sforce.com/2006/04/metadata';
$client = new SoapClient($wsdl, $option);

$header = new SoapHeader($namespace, "SessionHeader", array ('sessionId' => $token)); // NEED: access token
$client->__setSoapHeaders($header);
$client->__setLocation($serverUrl); // NEED: service endpoint URL
$serviceResult = $client->retrieve($params);

You'll need to provide an access token ($token) and a service endpoint ($serverUrl).