build: update vulnerable Composer development dependencies

[chubes4]

Problem

composer audit on current main reports three high-severity advisories in development dependencies:

• phpunit/phpunit before 9.6.33: CVE-2026-24765 / GHSA-vvj3-c3rp-c85p
• squizlabs/php_codesniffer before 3.13.6: CVE-2026-67434 / GHSA-hmqg-cxww-wqhq
• wp-coding-standards/wpcs before 3.4.1: CVE-2026-45293 / GHSA-3pwp-g2mj-5p3v

Acceptance criteria

• Raise the affected development dependency constraints to patched releases compatible with PHP 8.3.
• Refresh composer.lock without unrelated dependency churn.
• composer audit, tests, and PHPCS pass.

Discovered while verifying #155; intentionally kept out of that structural PR.