Make installing the proxy from a repository archive the documented way

[sgiehl]

Why

The README documents git clone as one of the installation methods. A checkout contains a lot that an installation does not need — the test suite, the CI configuration, the coding standard rules and the git metadata itself — and none of that belongs in a public web root. Installing from an archive keeps the installed directory to the files the proxy actually consists of.

What

• .gitattributes: export-ignore for tests/, .github/, phpcs.xml, .editorconfig, .gitignore, .gitattributes, .php-version and composer.lock. git archive output — and the source archives GitHub attaches to releases and serves from /archive/ — then contain only LICENSE, README.md, composer.json, config.php.example, the four entry points and plugins/HeatmapSessionRecording/configs.php. composer.json is kept deliberately: dropping it would break Composer-based consumption and it only lists dependency names.
• README: the source archive becomes the documented installation method, with a curl … | tar xz --strip-components=1 recipe and an update instruction noting that config.php is not part of the archive and is left untouched, while extracting over an existing installation never removes files. The clone instructions move to the contributing section as a development checkout, and the installation section points installations that contain a tests/ directory at cleaning it up.
• tests/server/matomo.php: this stand-in for a Matomo server is only meaningful together with the test configuration, so it now runs only when the loaded config points at tests/server/ and returns 403 otherwise — the same gate .github/config.php already uses for its test-only header hooks. Its non-image responses also get an explicit text/plain content type plus nosniff instead of falling back to whatever the web server assumes. A new test covers the refusal, via a new X-Test-Non-Test-Config hook in the test configuration.

Notes

• export-ignore only affects archives generated after this is merged, so the archives of the existing tags still contain the development files. The README therefore points at the master archive, which is clean as soon as this lands. Once a tag is cut on top of this, the README can document the tagged archive as the primary download.
• The README's copy of the test config.php is kept in sync with .github/config.php by hand; that duplication predates this PR, but is worth replacing with a pointer at some point.

Tests

vendor/bin/phpunit -c tests/phpunit.xml.dist — 95 passed, 254 assertions, including the new one. Verified that the new test fails when the check in tests/server/matomo.php is removed, and that git archive output matches the file list above. vendor/bin/phpcs is clean.