Update dependencies to address security advisories, #PG-5387

[snake14]

Description

Brings the Matomo 6 line up to the same dependency versions as 5.x-dev, which fixed several security advisories in #641. Without this the Matomo 6 release would ship the vulnerable versions.

This PR is based on prepare6x, not 6.x-dev, and should merge into #639. The regenerated tree has to be built against the PHP floor the plugin will actually have: #639 raises it from >=7.2.5 to >=8.1.0, so building on 6.x-dev today would produce a tree transpiled for PHP 7.2 that #639 then invalidates.

It is deliberately not a cherry-pick of the 5.x commit. That commit's vendor/prefixed tree is php-scoper output for a PHP 7.2 floor — it ships symfony/polyfill-php80 and a Rector downgrade to PHP 7.3, neither of which belongs at 8.1. The tree here was regenerated from scratch.

What changed:

• composer.json — apiclient ^2.15.3 → ^2.19.4, apiclient-services ^0.224.1 → ^0.454.0, guzzle 7.10.1 → 7.15.3, psr7 2.10.4 → 2.13.0, phpseclib 3.0.52 → 3.0.56. The explicit paragonie/constant_time_encoding pin is dropped, matching 5.x — it remains as a transitive dependency. The PHP floor stays as prepare6x sets it.
• scoper.inc.php — taken from 5.x-dev, carrying the patchers written for Update dependencies to address security advisories, #PG-5387 #641: prefixing phpseclib class names held in string literals, keeping PHP's Override attribute global, and moving scoped attributes onto their own line.
• config/config.php — loads the scoped trigger_deprecation() directly. Composer keys file-autoloading by a hash of package and path, identical across every plugin scoping the same package, so only the first plugin to load gets its copy; psr7 2.13 calls the function unconditionally. The 5.x change also guards the php80 polyfill for the same reason, which is dead code at this PHP floor and is left out.
• .github/workflows/min-php-lint.yml — lints every scoped file against the minimum PHP, since tests only parse a file when something loads it. Set to 8.1 here rather than 5.x's 7.2.
• vendor/prefixed/** and the autoloader metadata — regenerated.

config.platform.php is now pinned to this branch's minimum PHP. Without it Composer resolves against whatever PHP the developer happens to run — mine was 8.3 — and silently produces a lock that will not install on the minimum the plugin declares. That is what broke PHPCS on the first push here: ramsey/uuid pulled in brick/math 0.18, which requires PHP 8.2, so composer require failed outright on CI's 8.1. With the pin it resolves to brick/math 0.13.1 and the CI step passes.

No Rector downgrade is needed once resolution is correct. The intermediate commit on this branch applied one at DOWN_TO_PHP_81, because the bad lock had put PHP 8.2's final readonly class into the scoped tree; the re-scope after fixing resolution removes the need entirely, and a dry run now changes nothing but trailing whitespace. The README's Rector snippet is still updated to DOWN_TO_PHP_81, since that is the correct level for this line if a future dependency ever does need it, and it now also documents the platform pin. The config itself is deliberately not committed, as the README already says it belongs in a separate project.

Verified after regenerating: no unprefixed GuzzleHttp, phpseclib3, Google, Firebase, Psr or Symfony\Polyfill namespace remains under vendor/prefixed, every installed package has a scoped counterpart, all 2211 files in the scoped tree pass php -l on PHP 8.1 itself rather than on a newer local PHP, composer update reports no remaining advisories, and the exact composer require matomo-org/matomo-coding-standards step that PHPCS failed on was replayed inside a PHP 8.1 container and succeeds. The autoloader still emits the pre-existing ambiguous-class warnings for google/common-protos, which ships the same metadata classes under two paths; that is unchanged by this PR.

Issue No

PG-5387, on the 6.x line. Equivalent of #641.

Steps to Replicate the Issue

1. Compare composer.json on 5.x-dev and the 6.x line.
2. Expected: both on the versions that resolved the advisories.
3. Actual, before this PR: the 6.x line still requires guzzle 7.10.1, psr7 2.10.4, phpseclib 3.0.52 and apiclient ^2.15.3.

Checklist

• [✖] Tested locally or on demo2/demo3?
• [✔] New test case added/updated?
• [NA] Are all newly added texts included via translation?
• [NA] Are text sanitized properly? (Eg use of v-text v/s v-html for vue)
• [NA] Version bumped?
• [✔] I have understood, reviewed, and tested all AI outputs before use
• [✔] All AI instructions respect security, IP, and privacy rules
• [NA] Documentation updated?