Update packaging and tooling

[chrisjenkinson]

This brings the package metadata and tooling up to date:

• ext-mbstring is a runtime requirement, since the lexer uses mb_* functions, and the unused ext-libxml is dropped.
• The PHP 7.1 Dockerfile and Xdebug 2 config are removed. CI already tests every supported PHP version.
• .php_cs.dist is replaced by a PHP-CS-Fixer v3 .php-cs-fixer.dist.php that keeps the existing style: imported classes, no leading \ on functions, and aligned = and =>. friendsofphp/php-cs-fixer is added as a dev dependency, with composer cs and composer cs-fix scripts. The code is reformatted once, and composer test now includes the style check. mb_str_functions is left out because it would break the byte-offset code in Cursor and produce mb_trim(), which PHP 8.2 and 8.3 don't have.
• CI uses actions/checkout@v7 and actions/cache@v6 and runs composer validate --strict, and Dependabot now also updates GitHub Actions.