Build(deps-dev): Bump vimeo/psalm from 3.8.5 to 3.9.0

[dependabot-preview]

Bumps vimeo/psalm from 3.8.5 to 3.9.0.

Release notes

Sourced from vimeo/psalm's releases.

Improve initialisation

Running psalm --init can be confusing for first-timers.

When you run --init in the latest version it will scan your project to figure out the most appropriate starting level (here's an exhaustive list of all the error levels, and what they mean: https://psalm.dev/docs/running_psalm/error_levels/).

Instead of creating a large config file with a lot of issues, Psalm will now just make a note of the error level at the top of the file (this approach is modelled after PHPStan, which has used it for a number of years).

Other features

• calling assert(...) on an value right after assigning to it cancels out any MixedAssignment issues (#2442)
• this adds lowercase-string for when you want the type system to enforce a given string's lowercased-ness. Mainly used for Psalm internals.
• Psalm will now automatically run in multiple processes wherever possible

Bugfixes

• A few small bugfixes when using --diff mode
• Fixed an issue when overriding FilterIterator::accept – thanks @weirdan! (#2761)
• Allow properties with generic types to be initialised to equivalent objects with empty generic params (#2771)
• Add support for multiple closure params when calling array_map (#2772)
• Warn about possible paradoxes in assert calls (#2742)
• Prevent checkstyle being corrupted when using Shepherd - thanks @staabm! (#2778)
• Improve templating for method calls on objects that implement template params (#2764)
• Improve filter_var output slightly (#2780)
• Don’t crash when get_class arg type cannot be inferred, then used in static call (#2784)
• Improve wildcard parsing in new const docblock types (#2785)
• @orklah added a missing config referenced in #2737
• @weirdan fixed JSON report output (#2792)
• Ensured Numeric was not a reserved class name (#2789)
• Allow trailing commas in @return object-like types (#2798)
• @caugner fixed #2799, allowing DOMNode::$parentNode to be nullable
• @weirdan updated the PHPStorm-specific language server docs in line with @zmitic's suggestions
• @pilif added a function hook that's called after every function call (rather then every call that Psalm can understand) (#2804)
• Properly fix @throws self (#2765)
• Fix some false-positives where Psalm couldn't infer docblock return types inherited from interfaces (#2775)
• Improve handling of negated assertions on templated class strings (#2819)
• Improve handling of yield types when using templates (#2808)
• Ensure using (object) casts doesn't result in crashes when re-analysing a file (#2826)
• Ensure yield from expressions are treated as being used (#2823)
• Allow unpacking of non-arrays that contain template params (#2824)

Commits

• 9866b29 Suppress issue that appears in Windows
• 320f3ec Update level config name
• a55686b Move to more appropriate location
• 2cb3d0f Fix error level docs
• aab8eed Fix Phar-scoped issue checks
• 0c2b107 If no level or totallyTyped is given, use level 2
• f49c896 Allow totallyTyped to control level
• e48d2ae Improve handling when threads cannot be used
• a2c2a55 Update documentation
• ced0928 Make config generation smarter
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot will merge this PR once CI passes on it, as requested by @ergebnis-bot.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in the .dependabot/config.yml file in this repo:

• Update frequency
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)