feat!: replace $args arrays in widgets and mediapool with dedicated parameters

[gharlan]

Summary

The $args arrays on the four getWidget() methods (LinkVar, LinkListVar, MediaVar, MediaListVar) were a relic of the removed REX_VAR parser, which could inject arbitrary key-value pairs from module code. In practice, exactly three keys were ever consumed: category, types and preview. This PR replaces the arrays with dedicated, typed parameters — end to end:

• Widgets: LinkVar/LinkListVar take ?int $category; MediaVar/MediaListVar take ?int $category, list<string> $types, bool $preview. The generic foreach ($args) URL forwarding is gone (also fixes the urlencode inconsistency between the two media widgets).
• Callers: Form\Field\ArticleField/MediaField and the two MetaInfo fields pass the values directly; Form\Field\MediaField::setTypes() now accepts a list<string> instead of a comma-separated string.
• MediaPool: MediaPool::isAllowedExtension()/getAllowedExtensions() and MediaHandler::addMedia() take list<string> $types instead of the raw widget-args array (the addMedia() parameter was misleadingly named $allowedExtensions before).
• Wire format: the mediapool popup now uses a plain types request param instead of the generic args[] roundtrip through URLs and hidden fields. The comma-separated string is parsed exactly at the request boundaries (media.list.php filter, upload.php).

BC break (intentional)

• The getWidget() signatures change; addons calling them (e.g. YForm) need to adapt when porting to 6.x.
• Custom args[...] keys are no longer forwarded to the mediapool popup. This was a feature without consumers: no extension point in the mediapool ever received the args, they were only round-tripped.

Obsolete PHPStan/Psalm baseline entries have been removed accordingly (no regeneration, only removals).

Verification

• composer cs, composer sa, composer taint green; MediaPoolTest adapted (24/24 passing)
• Manual smoke test on a live instance: ?page=mediapool/media&types=jpg,png shows the filter message, subpage links and the list/upload forms carry the types param, upload validation receives it; without the param nothing leaks into URLs or forms