IBX-12654: Added ibexa/phpstan and fixed dynamic calls to static methods

[bnowak]

🎫 Issue	IBX-12654

Related PRs:

• IBX-12654: Enabled the PHPStan strict rule for dynamic calls to static methods phpstan#16

Description:

Adds ibexa/phpstan as a dev dependency and includes its extension in the PHPStan configuration.

Replaces dynamic calls to static methods ($this->assertX(), static test helpers, ...) with self::/ClassName:: calls: 315 calls in 69 files. The staticMethod.dynamicCall strict rule itself is enabled in the linked ibexa/phpstan PR; this PR keeps CI green once that is released.

Also fixes what the existing ibexa/phpstan rules report: 13 closures/arrow functions got return types (Ibexa.requireClosureReturnType).

Worth knowing:

• 254 of the calls are $this->assertXMLTag(...) → self::assertXMLTag(...). Most of them passed a superfluous trailing false argument that assertXMLTag($matcher, $actualXml, $message = '') never read; this was baselined as invoked with 4 parameters, 2-3 required. PHPStan words that error differently for static calls, so instead of re-baselining it the ignored argument was dropped and the 37 baseline entries PHPStan reported as no longer matched were removed. No behaviour change.
• The 3 ->getSubscribedEvents() calls on subscriber instances now use static call syntax: the concrete subscriber class where it is known, $eventListener::getSubscribedEvents() where only the interface is.
• RelationListProcessorTest: the router willReturnCallback closure fell through without a return after its two branches; it got an explicit self::fail('Unexpected call to generate().') so its : string return type is honest (the exactly(2) matcher already made that path unreachable).
• SonarCloud's Quality Gate fails on this PR ("15.0% Duplication on New Code", required ≤ 3%). This is not new duplication: the ValueObjectVisitor/Input\Parser test classes touched by the mechanical self::/dropped-argument edits above (e.g. RestObjectStateTest vs ObjectStateGroupTest, RestUserRoleAssignmentTest vs RestUserGroupRoleAssignmentTest) were already near-identical copy/paste test bodies before this PR; SonarCloud counts a whole pre-existing duplicate block as "new code" whenever any single line inside it changes. All other checks (PHPStan, code style, rector, unit/integration tests, REST functional tests) are green.

For QA:

No functional change. CI (PHPStan, code style, unit tests) is the verification.

Documentation:

No client-facing impact.

[sonarqubecloud]

Quality Gate failed

Failed conditions
15.0% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud