fix: resolve pre-existing phpstan and phpcs CI failures

Problem

The 4.1.x branch has pre-existing phpstan and phpcs failures that block CI on all MRs.

Changes

• Php.php: Add the DrupalPractice.CodeAnalysis.VariableAnalysis.UnusedVariable phpcs:ignore alongside the existing VariableAnalysis one — both sniffs flag the same eval-scope variable.
• CustomFormatters deriver: Cast base_plugin_definition to array before offset access.
• CustomFormattersTestBase: Loosen $adminUser's docblock to AccountInterface (was User|false) and drop the now-dead !== FALSE guard around drupalLogin().
• FormatterSettingAccessControlTest: Loosen $adminUser/$regularUser from native AccountInterface-typed properties to untyped-with-docblock, same reasoning as above.
• Test files: No \assert()/instanceof narrowing on drupalCreateUser()/createUser() return values — Drupal core's current stable ($CORE_STABLE, 11.4.x) types UserCreationTrait::createUser() as returning bare UserInterface, not UserInterface|false, so such a check is dead code phpstan flags as instanceof.alwaysTrue.
• phpstan.neon: Ignore entityStorageDirectInjection in FormatterListBuilder (required by ConfigEntityListBuilder's parent constructor), scoped with a leading-wildcard path so it matches regardless of which directory phpstan is run from.
• phpstan.neon: Targeted ignores for deprecated node_access_rebuild() and _contextual_links_to_id() (no replacement available yet in Drupal 11).

Why separate MR?

These issues are unrelated to any feature work. Splitting them out unblocks CI for all future MRs.