[12.x] Update phpunit version constraints to address CVE

[PerryvanderMeer]

GHSA-vvj3-c3rp-c85p

[GrahamCampbell]

This is not necessary. The vulnerability does not affect our code-paths in CI and we do want to test the earlier versions of PHPUnit for compatibility.

[GrahamCampbell]

@crynobone is probably the best person to decide what to do with this (aka whether we would rather stop testing PHPUnit 12.2 and only test the latest version of 12.x).

[crynobone]

This is unnecessary

[crynobone]

Also, latest Composer doesn't install package with known vulnerability unless explicitly stated via composer.json audit configuration. e.g:

    "config": {
        "audit": {
            "block-insecure": false
        }
    }