chore: resolve open dependabot security alerts

[jonathannorris]

Summary

Resolved 20 open Dependabot security alerts by bumping vulnerable dependencies across the SDK and example apps.

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#37, #34, #33, #32, #31, #28	guzzlehttp/guzzle	medium	Bumped to 7.13.1 in main + all example lockfiles
#36, #29	guzzlehttp/guzzle	medium	Bumped to 7.13.1 (HTTPS-Proxy downgrade)
#35, #30, #27, #26	guzzlehttp/psr7	medium	Bumped to 2.12.3 (CRLF injection in HTTP Start-Line)
#25, #23, #21, #20	guzzlehttp/psr7	medium	Bumped to 2.12.3 (CRLF injection via URI Host)
#24, #22, #19, #18	guzzlehttp/psr7	medium	Bumped to 2.12.3 (Host confusion via Authority reinterpretation)

Also bumped phpunit/phpunit 10.5.45 to 10.5.63 to resolve CVE-2026-24765 (unsafe deserialization in PHPT code coverage handling, high severity).

All 22 tests pass locally.

[Copilot]

Pull request overview

This PR updates Composer dependencies in the PHP Server SDK and example apps to address open Dependabot security alerts by bumping vulnerable packages (notably guzzlehttp/guzzle, guzzlehttp/psr7, and phpunit/phpunit) and regenerating lockfiles.

Changes:

• Bumped guzzlehttp/guzzle to 7.13.1 and guzzlehttp/psr7 to 2.12.3 in lockfiles.
• Bumped phpunit/phpunit (and related dev dependencies) in the root lockfile.
• Updated example app lockfiles to align with the patched dependency set.

Reviewed changes

Copilot reviewed 2 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
composer.json	Updates dependency constraints for Guzzle/Psr7 and PHPUnit.
composer.lock	Pins updated dependency graph (including Guzzle/Psr7 and PHPUnit transitive updates).
examples/hello-world/composer.lock	Updates example lockfile dependency graph to patched versions.
examples/hello-world-http-proxy/composer.lock	Updates example lockfile dependency graph to patched versions.
examples/hello-world-udp-proxy/composer.lock	Updates example lockfile dependency graph to patched versions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[JamieSinn]

Test harness will likely need a version bump too for PHP

[jonathannorris]

The test harness Dockerfile at proxies/php/Dockerfile currently installs php81 via Alpine packages. The harness CI runs have been failing consistently since at least August 2025 with a Jest ESM configuration error (SyntaxError: Cannot use import statement outside a module), which is unrelated to the PHP version. I'll file a separate issue in the test-harness repo to track both the Jest config fix and the PHP version bump.