Add code style and static analysis checks to the test workflow so CI
can catch regressions beyond the existing test suite. PHPStan settles
at level 8 (larastan's Testbench app boot fails on an unrelated
webpatser/resonate/fledge-fiber Http\Client\Factory incompatibility,
so plain phpstan/phpstan is used instead).

TokenAuthPlugin::authenticate() and resolveClaims() now take the
already-null-checked authenticator as a parameter instead of reading
it back off the nullable property, satisfying level 8's null-safety
check without changing behaviour. Also drops a redundant empty-string
check on a json_encode() result that PHPStan proved is always
non-empty.