Native Observability 1.1.0

First minor release since 1.0.11. It carries new public surface, which is why
it is not 1.0.12: a JSON records endpoint, new services, a new configuration
key and two new export query parameters that did not exist before.

UPGRADE NOTES

- Run `drush updb`. native_observability_export_update_10002() decides the
  access model of the Prometheus scrape endpoint on your site. Without it, a
  site that scrapes without a bearer token will start being refused.
- The module now ships a root composer.json declaring php >=8.2, above
  Drupal 10's own minimum. A Drupal 10 site on PHP 8.1 will not be offered
  this release and stays on 1.0.11.
- CSV export filenames changed shape. Automation that collects them by name
  needs adjusting.

NEW

- Slow query records are served over a new route,
  native_observability_dashboard.api.database_records, as one gzip-compressed
  response instead of being embedded in the page. The module negotiates the
  compression itself rather than relying on web-server configuration.
- Each dashboard tab loads only its own JavaScript. Overview, Cache, Database
  and Forensic have a library and a bundle apiece over a shared base and the
  charting engine, replacing the single bundle every page used to download.
- Export links pin the window they were taken from. An export followed minutes
  after reading a table now returns that table, not a window that slid forward
  in the meantime. A from/to pair is honoured only when it spans exactly the
  duration its range key names and does not end in the future.
- The Prometheus scrape endpoint refuses unauthenticated requests on new
  installs, with an explicit "Serve without a bearer token" opt-in and a
  security warning on the settings page for sites that need the old behaviour.
- retention.max_rows is enforced by the cleanup handlers, which previously
  read the setting without acting on it.
- The report has an Italian narrative, and the narrative keys it only had
  fallbacks for are now defined.
- Documentation is published as a MkDocs site, with in-Drupal help pointing at
  it, screenshots of every settings tab, and a redrawn dependency graph.
- The next-major compatibility analysis runs instead of being disabled.

FIXED

- The slow query records table was empty; it is filled again, its pager has
  the shared markup back, and the route and hotspot popups open again.
- The slow query threshold is read from one place everywhere, instead of two
  values disagreeing.
- The container compiles when the database observer is not installed.
- Sorting a cache record table reorders the rows on screen. It used to reorder
  only the backing array, so a sorted column changed which rows landed on a
  page without changing the order they were read in.
- Activity that never resolved a route is labelled instead of showing a blank
  cell, and no longer carries an inspect control that filters by an empty
  route and opens nothing.
- A chart in a panel that starts hidden waits to be told the panel opened,
  through a resize observer, instead of re-checking on every animation frame
  for as long as the panel stayed shut.
- The delete-all-spans confirmation is reachable again.
- Injected properties survive form serialization.
- Interface controls no longer leak into CSV exports, and the server-side
  exports use the same filename shape as the client-side ones.

REMOVED

- The dashboard library is now a dependency-only alias over the base and the
  four section libraries. It keeps working for anything outside the module
  that attaches it. js/dashboard.js and its esbuild entry are gone.
- The server-side PDF exporter, which was never wired to anything.
- CHANGELOG.md, in favour of the release notes on drupal.org.
- A tracked .bak copy of the forensic template and a stray
  module-description.html.

DEVELOPMENT

- phpstan raised to level 6 across the module, with the iterables typed in
  every sub-module and the guards the type system proves unreachable removed.
- The test suite runs against the previous major on the declared PHP floor.
- ECA is installed in CI so the bridge can be analysed, and the phpstan gate
  is on again.