lint (php) fails on every MR: phpstan/phpstan-phpunit 2.1.0 requires PHPStan 2.3

Problem

Since this morning, lint (php) fails during the composer step on every MR, and all later jobs are skipped. phpstan/phpstan-phpunit 2.1.0 was released on 2026-10-06 at 07:32 UTC and requires phpstan/phpstan ^2.3.0. Canvas pins phpstan/phpstan to exactly 2.2.16, so the dependencies can't be resolved.

Example: https://git.drupalcode.org/issue/canvas-3592162/-/jobs/12680538

Problem 1
  - Root composer.json requires phpstan/phpstan 2.2.16 (exact version match: 2.2.16 or 2.2.16.0), found phpstan/phpstan[2.2.16] but these were not loaded, likely because it conflicts with another require.

Proposed resolution

Pin phpstan/phpstan-phpunit to 2.0.21, matching how the other PHPStan packages are pinned, and add it to the package list in phpstan-is-up-to-date.

Bumping PHPStan to 2.3.0 instead reports 12 new errors. Some of them look like false positives in the new release, for example "assertNotNull() with mixed will always evaluate to true". That bump is better done separately, once 2.3.x settles.