feat(php): add PHP Composer ecosystem support

[lachaib]

Summary

• Adds PhpAnalyzer implementing full threat detection for PHP Composer packages via the Packagist registry
• 36 PHP-specific security patterns covering code execution, shell access, deserialization, obfuscation, network I/O, filesystem writes, environment access, and CI credential targeting
• Composer lifecycle script detection (post-install-cmd, pre-install-cmd, post-update-cmd, etc.) as install hooks
• Packagist API client with version resolution, artifact download, registry metadata, and metadata delta computation
• GitHub zipball top-level directory stripping for consistent cross-version file path comparison
• php: 'Packagist' added to OSV vulnerability database mapping
• Packagist public registry URLs (api.github.com, codeload.github.com) added to registry confusion heuristics
• 'composer-script' added to InstallHook.type union
• 39 tests: 35 unit tests for patterns + hook detection, 4 integration tests (added, updated, removed, registry change)
• Bumps lockdelta to ^0.1.4 which includes composer.lock parsing support

Test plan

• Unit tests: pnpm test — 39/39 pass
• Type check: pnpm typecheck — no errors
• Lint: pnpm run check — no errors

🤖 Generated with Claude Code