Perf: cache UseStatementsTrait getUseStatements + bound throw class-name lookup

[dereuromark]

Summary

Follow-up to #62 and #63. Two changes in UseStatementsTrait / DocBlockThrowsSniff:

1. Cache getUseStatements() per file in UseStatementsTrait. The result is currently rebuilt once per T_FUNCTION by every sniff that uses the trait, but it's a per-file quantity. On a large method-heavy controller this turns a per-file O(file_size) walk into per-method O(methods × file_size). The trait is used by DocBlockThrowsSniff, DocBlockVarSniff, and UseWithAliasingSniff, so all three benefit.
2. Bound the T_DOUBLE_COLON lookup in extractExceptions() to the current statement. The original code searched up to $scopeCloser (the method's closing brace), which on long bodies could pick up an unrelated :: operator from a later statement and silently use it to gate exception collection for this throw. Bounding to the next ; is both faster and more correct.

Why this was slow

getUseStatements() iterates every token in the file:

foreach ($tokens as $index => $token) {
    if ($token['code'] !== T_USE || $token['level'] > 0) {
        continue;
    }
    // ... parse the use line
}

That's an O(file_size) walk per call. DocBlockThrowsSniff::compareExceptionsAndAnnotations() calls it once per method, so an 11k-token controller with ~100 methods does ~1.1M token reads per file just to repeatedly rebuild the same use list. Same shape of bug we caught in AbstractSniff::getClassName() in #62.

Cache invalidation

The static cache has to survive phpcbf's fix loop, which calls $file->reloadContent(); $file->process(); on the same File object after each fix iteration. Token count alone isn't enough: a fix that renames an alias (use Foo as Bar; -> use Foo as Baz;) leaves the count unchanged, and other sniffs would then read stale aliases out of the cache. (Caught in codex review on the first draft.)

The cache therefore stores a content fingerprint of each use statement range (start..end token contents concatenated) and re-verifies it against the live tokens on every cache hit. The verification is O(num_uses × avg_use_length) — typically a handful of token reads — so the cache stays cheap.

Benchmarks

Measured on the same 1095-file CakePHP 5 app from #62 / #63 (ResidentsController.php, 11k LOC, ~100 actions). The phpcs --report=performance figures are the per-sniff CPU times reported by phpcs itself, so they're not affected by background system load the way wall-clock figures are:

	Before (master)	After this PR
DocBlockThrows on ResidentsController.php (median, 3 runs)	~3.25s	~0.08s (≈ 40× speedup)
DocBlockThrows across all 1095 files, parallel=1 (median, 3 runs)	~11.32s	~0.86s (≈ 13× speedup)

DocBlockThrows was the #1 hot spot in the perf report after #62 / #63 landed (~19% of total time). It's now down to ~1–2%.

Why not the combined-scan refactor

An earlier draft of this PR replaced the four overlapping body scans in process() (extractExceptions / containsComplexThrowToken / containsThrowToken / containsCatchToken) with a single combined pass that tracked nested-closure boundaries via a running cursor. It worked correctly, but a controlled 3-run measurement showed it brought the sniff from 3.25s to 3.21s on ResidentsController.php — completely within noise. The four-scan structure looks expensive but the inner-loop short-circuits made it cheap in practice; the actual hot path turned out to be the un-cached getUseStatements() call called from compareExceptionsAndAnnotations(). So the refactor was dropped; the existing four helpers are kept untouched.

Verification

• Existing PHPUnit suite passes (100 tests / 122 assertions).
• composer cs-check and composer stan on this repo: clean.
• Output diff across all sniffs and all 1095 files of the activity-pro test corpus: identical violations before vs after.
• Cache invalidation: a fixture that renames an aliased use statement in place (same token count, different alias) correctly produces fresh parse output on the next call; the cache rejects the stale entry via fingerprint mismatch.
• codex review --uncommitted on the final patch: addressed the one P2 finding (cache invalidation strength) before commit.