Upgrade to PHPStan 2.3 and remove the phpstan/phpstan-phpunit 2.0.21 pin

Overview

#3592168 (closed) pins phpstan/phpstan-phpunit to 2.0.21 to unblock CI. Release 2.1.0 requires phpstan/phpstan ^2.3.0, and Canvas pins phpstan/phpstan to 2.2.16.

This pin is temporary. Canvas cannot get new phpstan/phpstan-phpunit releases until it upgrades to PHPStan 2.3. Also, a future drupal/core-dev release can require phpstan/phpstan-phpunit ^2.1 or phpstan/phpstan ^2.3. Then the pin causes a new dependency conflict.

Proposed resolution

Upgrade phpstan/phpstan to 2.3.x and phpstan/phpstan-phpunit to 2.1.x, with the same exact-version pins.

PHPStan 2.3.0 reports 12 new errors on Canvas. Some look like false positives in the new release, for example "assertNotNull() with mixed will always evaluate to true". For each error, fix the code, or report the false positive upstream and ignore it.

Remaining tasks

• Upgrade to the latest PHPStan 2.3.x release and to phpstan/phpstan-phpunit 2.1.x.
• Fix or ignore the new errors. Report false positives upstream.
• Confirm lint (php) and the nightly PHPCS + PHPStan freshness checks pass.

User interface changes

None in this issue.