chore: upgrade PHPStan 2.x + Rector 2.x

[tonydspaniard]

Summary

Closes the PHPStan-2.x part of #96. PHPStan 2.x is version-locked to Rector 2.x (Rector 1.x pins phpstan ^1.12.5), so both are upgraded together.

• composer.json: phpstan/phpstan ^1.12 → ^2.1, rector/rector ^1.2 → ^2.0.
• Rector 2.x sweep (~94 files) — behaviour-preserving modernizations from the expanded rule sets: SafeDeclareStrictTypes (34), first-class-callable syntax (strlen(...)), explicit closure/array param types, ThrowWithPreviousException, removal of no-op ReflectionProperty::setAccessible() calls, redundant-cast removal, etc.
• PHPStan baseline regenerated under 2.x: level 6 is stricter in 2.x, so the grandfathered count rises 51 → 80 errors — to be burned down later under Burn down PHPStan baseline and raise level 6 → 8 (Phase 4) #96 (the level is unchanged; this is just the 1.x→2.x move).

Manual corrections to Rector output

• Pair::__get / PriorityNode::__get: Rector added : mixed but left a bare return; (a fatal with a typed return). Completed to return null; — faithful to the prior null-returning behaviour and the @return mixed|null docblock.
• Skipped RemoveParentDelegatingConstructorRector globally: it removed Cookie::__construct(), which is not dead — it widens AbstractCookie's protected constructor to public. Restored the constructor and documented the skip in rector.php.

Test plan

• composer cs — clean
• composer stan (PHPStan 2.1) — [OK] No errors
• vendor/bin/rector process --dry-run (Rector 2.4, full codebase) — clean and stable with cs-fixer (no tug-of-war)
• composer test — 5555 tests; only the pre-existing local MongoSessionHandlerTest env errors (CI loads ext-mongodb)
• composer validate --strict — valid

Note: the baseline was regenerated on PHP 8.5 locally; PHPStan analyses with phpVersion: 80300 so results should be deterministic on CI's PHP 8.3. CI will confirm.