This PR bundles three distinct fixes under the N°9383 ticket: a targeted error-handling improvement in the stimulus/transition flow, a security hardening in the synchronization import page, and an information-disclosure removal from the Universal Search page. Test dependencies are also bumped as a maintenance task.

• pages/UI.php: A new catch (CoreCannotSaveObjectException $e) block is inserted before the existing catch (CoreException $e) block. Because CoreCannotSaveObjectException extends CoreException, without this specific handler the exception was previously caught generically and error messages were retrieved via getMessage(). The new handler calls $e->getIssues() to retrieve the structured issues array, which is the purpose of the specialized exception. The rollback logic (reload object + re-apply posted form fields) is identical to the CoreException path. One minor style note: implode(' ', $e->getIssues()) joins issues with a plain space, while getMessage() would produce ', '-separated output; using a clearer delimiter would improve readability.
• pages/UniversalSearch.php: Removes the OQL filter being written into an HTML comment (<!-- $sFilter -->), closing an information-disclosure path that could expose data-model internals to anyone viewing page source.
• synchro/synchro_import.php: Replaces the 'raw_data' sanitization filter for data_source_id with utils::ENUM_SANITIZATION_FILTER_INTEGER, ensuring the parameter is properly sanitized before use.
• tests/php-unit-tests/composer.lock: Routine dev-dependency updates (PHPUnit 9.5→9.6, nikic/php-parser 4→5, doctrine/instantiator 1.5→2.0, various sebastian/* packages). doctrine/instantiator 2.0.0 now requires PHP ≥ 8.1 — this only affects test execution environments, not the runtime application.

• This PR is safe to merge; all changes are targeted fixes or housekeeping with no breaking runtime impact.
• The core logic change (new catch block) is correct — CoreCannotSaveObjectException is a subclass of CoreException so the ordering is right, and the rollback is consistent with the existing handler. The only non-critical concern is the implode(' ', ...) separator choice. The security fixes in UniversalSearch.php and synchro_import.php are straightforward and clearly beneficial. Composer lock bumps are dev-only.
• Pay attention to pages/UI.php — specifically that the $sIssues separator used in the new catch block produces less readable output than the existing getMessage() approach.