All three QA gates were red on this branch, two of them because a tool
config referenced a constant that upstream had removed, so the job died
before analysing anything.

- ECS imported `SetList::PHPUNIT` and `SetList::STRICT`, both gone from
  Easy Coding Standard. Dropped; STRICT's three fixers were already
  registered explicitly. `OrderedImportsFixer` was registered bare, which
  silently discarded the `class, function, const` order that CLEAN_CODE
  sets, so it is now configured explicitly. 35 files reformatted.
- Rector imported `PHPUnitSetList::PHPUNIT_120`, folded upstream into the
  version-aware sets. Dropped; `withComposerBased(phpunit: true)` was
  already selecting the right rules. The 89 files it then wanted to
  rewrite are applied here: PHPUnit 12 method renames, Symfony console
  attributes, and dead-code removal.
- PHPStan dropped the `ergebnis/phpstan-rules` and
  `phpstan-beberlei-assert` extensions, matching 4.2.x. ergebnis alone
  accounted for 777 of the 1694 baseline entries, which is to say the
  code never followed it.

The 34 errors PHPStan then reported are fixed rather than baselined,
mostly types tightened by brick/math and Symfony: `non-empty-string` for
`BigInteger::fromBase`, positive lengths for `random_bytes` and
`randomBits`, `crit` and `key_ops` validated as lists of strings.
Two Symfony denormalizer covariance errors remain baselined, as on 4.2.x.

`JWKFactory::createOctKey()` now rejects sizes below 8 bits, which only
turns an already-broken zero-length secret into an explicit error.

Test results are unchanged: the same 38 pre-existing failures, all in the
bundle configuration tests.