* fix(fake-credentials): deprecate SimpleFakeCredentialGenerator without a secret (GHSA-gq4g-fpc9-vjfq)

With an empty secret the decoy credentials derive only from the username
and become predictable, letting an unauthenticated requester tell fake
responses from real ones and re-enabling username enumeration. Emit a
deprecation when the generator is built without a secret; a non-empty
secret will be required in 6.0.0. The Symfony bundle already injects
kernel.secret, so default deployments are unaffected.

* test(fake-credentials): cover empty-secret deprecation and secret-driven unpredictability (GHSA-gq4g-fpc9-vjfq)

Validates the fix and guards against regressions:
- a deprecation is emitted only when no secret is provided
- a non-empty secret keeps the fake list unpredictable from the username alone
- documents the empty-secret reproducibility the fix warns about
- output stays deterministic per (username, secret) and varies per username