Add a matrix so CI verifies compatibility across the full supported
PHP range instead of a single pinned version, and switch the
Composer step to 'update' so each PHP version resolves the PHPUnit
release it actually supports rather than being bound to the
committed PHPUnit 12 lock file. Also bump actions/checkout to v4,
php-actions/composer to v6, and php-actions/phpunit to v4.