Fix unsafe PHPCS pull request workflow

[RabbiIslamRony]

PR Type

What kind of change does this PR introduce?

• Bugfix
• Security fix
• Improvement
• New Feature
• Refactoring (no functional changes, no api changes)
• Build related changes
• Text changes
• Other... Please describe:

Description

How to reproduce the issue or how to test the changes

1. Open a pull request from a fork that changes a PHP file and confirm the PHPCS workflow runs on the unprivileged pull_request event with read-only contents permission.
2. Confirm checkout uses the pull request merge commit through actions/checkout@v4, does not persist credentials, and never checks out github.event.pull_request.head.sha under pull_request_target.
3. Confirm changed PHP paths are passed to composer phpcs with null-delimited filename handling; a workflow-only change should complete without attempting an empty PHPCS invocation.
4. Confirm PHPCS errors in changed PHP files fail the job while the repository's pre-existing warning-only backlog remains non-blocking.

Local validation completed with Actionlint, YAML parsing, workflow-only path detection, changed-PHP argument forwarding against legacy files with existing warnings, Composer manifest validation, and git diff --check.

Any linked issues

Fixes #2860

Checklist

• My code follows the WordPress coding standards