Fix Rector config and clear high-severity npm audit findings

[srtfisher]

Two independent CI failures, both pre-existing on develop.

Rector

composer rector was failing outright before it linted anything:

[ERROR] Undefined constant Rector\PHPUnit\Set\PHPUnitSetList::PHPUNIT_100

The rector-phpunit bundled with rector/rector 2.x dropped the version-pinned sets (PHPUNIT_100, PHPUNIT_110, …). PHPUnitSetList now only exposes PHPUNIT_MOCK_TO_STUB, PHPUNIT_CODE_QUALITY, PHPUNIT_NARROW_ASSERTS, ANNOTATIONS_TO_ATTRIBUTES, and COMPOSER_BASED.

• Swap the hard-coded version sets for ->withComposerBased( phpunit: true ), which binds each rule to the PHPUnit version actually installed per composer.json — so this no longer needs editing when the PHPUnit constraint moves.
• Swap PHPUnitSetList::ANNOTATIONS_TO_ATTRIBUTES for the equivalent ->withAttributesSets( phpunit: true ), which drops the now-unused PHPUnitSetList import.
• Empty out ->withSkip(): DisallowedEmptyRuleFixerRector is deprecated and no longer registered by any set, and Rector warns to remove it. The section is kept as the documented place for future skips.

npm audit

The Node job runs npm audit --audit-level=high --omit=dev --package-lock-only, which was reporting four high and one critical advisory. All five are transitive, and all have a patched release inside the major already in the tree, so they're pinned forward with overrides — the same approach #538 took for fast-uri:

Package	Was	Now	Severity
fast-uri	3.1.2	3.1.6	high — the existing override predates the advisory being widened to cover ≤ 3.1.4
js-yaml	4.1.1	4.3.1	high — quadratic-complexity DoS via merge keys, !!omap
nanoid	3.3.8	3.3.18	high — non-secure generators loop indefinitely on negative/zero size
postcss	8.5.1	8.5.26	high — XSS via unescaped </style>, arbitrary .map read via sourceMappingURL
seroval	1.5.1	1.6.4	critical — fromJSON() type confusion invokes attacker-controlled methods

The js-yaml override is keyed js-yaml@^4 because a 3.14.2 copy also lives in the tree and js-yaml 4 is a breaking API change; only the 4.x copy is in the advisory range, so the 3.x one is left alone.

npm audit fix isn't usable here — it tries to resolve the react 18 / react-dom 19 peer conflict in @wordpress/edit-post and aborts.

31 moderate/low advisories remain, all in @wordpress/* transitives with no in-range fix. They're below the --audit-level=high threshold and out of scope for a CI fix.

Verification

• composer rector exits 0 with no warnings; vendor/bin/phpcs rector.php passes.
• npm audit --audit-level=high --omit=dev --package-lock-only exits 0.
• After npm ci against the regenerated lockfile, npm run build and npm test (check-types + eslint + stylelint + jest) both exit 0.

[kaitlinbolling]

🍋