Issue #3618104: Bubble the generated URL cacheability out of the domain source token

Fixes #3618104.

DomainSourceToken::getTokens() ended each replacement with $bubbleable_metadata->merge($generated_url);. BubbleableMetadata::merge() builds $result = parent::merge($other) and returns a new object, leaving the one it was called on untouched, so the return value being discarded meant the merge never happened. Everything the generated URL carried was thrown away.

Concretely the absolute URL's url.site cache context never bubbled, so a rendered page containing a domain source token could be cached without varying by host and served across domains.

The fix uses the in-place call, matching core's own token hooks (SystemTokensHooks uses this shape three times, for url, url-brief and login-url):

$bubbleable_metadata->addCacheableDependency($generated_url);

This is not a behaviour reduction versus the intended merge(): BubbleableMetadata overrides addCacheableDependency() to call addAttachments() as well when the argument implements AttachmentsInterface, and GeneratedUrl extends BubbleableMetadata, so cache contexts, cache tags, max-age and attachments all transfer.

Note that satisfying the static analysis by using the return value ($bubbleable_metadata = $bubbleable_metadata->merge(...)) would leave the bug in place, because the caller holds the object being modified.

DomainSourceTokenCacheabilityTest asserts the url.site context reaches the metadata the caller passed in. Verified both ways on Drupal 11.4.4: it fails against the unpatched code with Failed asserting that an array contains 'url.site'. and passes with the change.

This also clears two red jobs on the next major lane, where one line was failing both: PHPStan method.resultDiscarded (marked non-ignorable, so it cannot be baselined) and the matching PHPUnit 12 warning, which run-tests.sh turns into a job failure even though every test passes.

Backports: !434 (merged) (3.x), !435 (merged) (3.0.x).