Make the quality gates pass again

[Spomky]

Target branch: 4.2.x

• It is a Bug fix
• It is a New feature
• It is related to dependencies

Includes:

• Breaks BC
• Deprecations

ECS and PHPStan had both drifted away from the tool versions in ghcr.io/spomky-labs/phpqa. This makes the three gates green again on 4.2.x.

Easy Coding Standard

ECS did not run at all: the configuration imported SetList::PHPUNIT and SetList::STRICT, two sets that no longer exist, and aborted before analysing anything.

• Both imports are dropped. The three fixers STRICT used to bring (DeclareStrictTypes, StrictComparison, StrictParam) are already registered explicitly, and ECS now considers the PHPUnit set unsafe to run outside of Rector.
• OrderedImportsFixer was registered without configuration, which silently discarded the class, function, const order that CLEAN_CODE had already set. That is the order the code base follows, so ECS reported a diff on 160 untouched files. It is now configured explicitly.
• The remaining drift is fixed: single line comment spacing, stray trailing commas in the #[AsCommand] attributes, and the closing parenthesis of the multiline ones.

One fix had to be written by hand. On Chacha20Poly1305KeyEncryptionTest, the fixer rewrote

$tag[0] = $tag[0] ^ "\xff";   // into
$tag[0] ^= "\xff";

which PHP rejects with Cannot use assign-op operators with string offsets. Both byte flips now go through substr_replace(); the flipped byte is unchanged.

PHPStan

The ergebnis rule set is removed from the configuration, as asked. It accounted for 777 of the baseline entries, so the code base never followed it. phpstan-beberlei-assert goes with it: beberlei/assert is not used anywhere in src/.

The rest came from type declarations tightened by brick/math, Symfony and PHPStan since the baseline was written. They are fixed rather than baselined:

• BigInteger, RSAKey, Math, AbstractECDH and KeyConverter reject the empty string before BigInteger::fromBase(), which now expects a non-empty-string.
• Curve::generate(), JWKFactory::createOctKey() and RSACrypt keep their lengths positive, as random_bytes() and randomBits() now require.
• crit and key_ops are checked to be lists of strings. Both are fed to array_diff() and implode(), which a nested array would have broken.
• KeyConverter requires the key entry it reads, and KeyConverter\RSAKey no longer indexes an array with the result of array_search(), which can be false.

Two real defects surfaced on the way:

• JsonConverter::decode() passed JSON_UNESCAPED_SLASHES and JSON_UNESCAPED_UNICODE to json_decode(). Both are encoding flags and were simply ignored.
• JWEBuilder had a ?? null on a property that is always set.

The baseline is regenerated so that it describes what is actually left, without the entries that no longer match anything.

Result

	Before	After
ECS	did not run	no errors
PHPStan	50 errors	no errors
Deptrac	0 violations	0 violations
PHPUnit	38 failures	the same 38 failures

The 38 remaining failures are pre-existing, all in the bundle configuration tests, and untouched by this PR.

Note for reviewers: two caches survive a branch switch and will give you stale results. var/cache/test holds the test kernel container, and tmp-phpqa/phpstan holds the PHPStan result cache. Clear both when comparing branches.