feat: use latest code sniffer

There's a [bug in its processing of constructor property promotion][1]
that is purportedly fixed in 3.6 (not released yet, so fallback to 3.x
dev head).

[1]:squizlabs/PHP_CodeSniffer#3182 (comment)

composer.json

@@ -40,7 +40,7 @@
   "require-dev": {
     "phpunit/phpunit": "^9",
     "mockery/mockery": "^1",
-    "squizlabs/php_codesniffer": "^3",
+    "squizlabs/php_codesniffer": "^3.6 || 3.x-dev",
     "phpmd/phpmd" : "^2"
   },