feat: add Saloon v4 support (CVE-2026-33182, CVE-2026-33183)

- Update saloonphp/saloon constraint to ^3.10|^4.0
- Update pagination-plugin to ^2.2|^2.3 and rate-limit-plugin to ^2.0|^2.5
- Fix Administrations endpoints: use relative paths instead of absolute
  URLs (absolute URLs are blocked in Saloon v4 to prevent SSRF)

Author: ClawdBot

composer.json

@@ -22,9 +22,9 @@
         "php": "^8.2",
         "guzzlehttp/guzzle": "^7.9",
         "kelunik/link-header-rfc5988": "^1.0",
-        "saloonphp/pagination-plugin": "^2.2",
-        "saloonphp/rate-limit-plugin": "^2.0",
-        "saloonphp/saloon": "^3.10"
+        "saloonphp/pagination-plugin": "^2.2|^2.3",
+        "saloonphp/rate-limit-plugin": "^2.0|^2.5",
+        "saloonphp/saloon": "^3.10|^4.0"
     },
     "require-dev": {
         "laravel/pint": "^1.17",

src/Api/Administrations/GetAdministrationRequest.php

@@ -16,12 +16,12 @@ public function __construct(
     }
 
     /**
-     * Returns the full URL to bypass the connector's base URL.
-     * The Administrations endpoint does not use an administration ID in the path.
+     * The Administrations endpoint does not use an administration ID in the path,
+     * so we navigate up from the connector's base URL (which includes the admin ID).
      */
     public function resolveEndpoint(): string
     {
-        return 'https://moneybird.com/api/v2/administrations/'.$this->id;
+        return '/../administrations/'.$this->id;
     }
 
     public function createDtoFromResponse(Response $response): Administration

src/Api/Administrations/GetAdministrationsRequest.php

@@ -10,12 +10,12 @@
 class GetAdministrationsRequest extends BaseJsonGetRequest
 {
     /**
-     * Returns the full URL to bypass the connector's base URL.
-     * The Administrations endpoint does not use an administration ID in the path.
+     * The Administrations endpoint does not use an administration ID in the path,
+     * so we navigate up from the connector's base URL (which includes the admin ID).
      */
     public function resolveEndpoint(): string
     {
-        return 'https://moneybird.com/api/v2/administrations';
+        return '/../administrations';
     }
 
     public function createDtoFromResponse(Response $response): Administration