task: #3630443: Move UI dependencies to suggest, default to the https endpoint, and add CI

Closes #3630443

Changes

Packaging

• composer.json: drupal/geocoder, drupal/leaflet and geocoder-php/nominatim-provider move from require to suggest and require-dev. overpass_api_ui.info.yml still declares them, so the submodule cannot be enabled without them. Only halaxa/json-machine stays in require.
• core_version_requirement: ^10.3 || ^11 and php: 8.1 on both .info.yml files.
• overpass_api and overpass_api_ui are listed under the OpenStreetMap package on the Extend page.

Endpoint

• The default endpoint becomes https://overpass-api.de/api/. overpass_api_update_10002() moves sites still on the exact old http default and leaves every other value alone.

CI

• Adds .gitlab-ci.yml (drupal.org GitLab templates, previous and next minor opted in), phpcs.xml.dist (Drupal, DrupalPractice), phpstan.neon (level 1) and .gitignore.
• Deletes tests/src/PHPCodeSniffer/Standard.php, which extended a class that does not exist in any PHP_CodeSniffer release and caused 55 of the 60 phpcs errors.
• All jobs pass: composer, composer-lint, cspell, eslint, phpcs, phpstan, phpunit, stylelint. To get there:
  • cspell: the module's domain words in _CSPELL_WORDS, typo fixes, and "Please" out of two strings.
  • phpcs: the remaining errors, checked with coder 8.3.31 (the pipeline's) and 9.0.1, which disagree on a few lines.
  • phpcs/phpstan: SettingsForm and QueryBuilderForm get their services injected through create() instead of calling \Drupal. The same code works with ConfigFormBase::create() on 10.3 and AutowireTrait on 11.x.
  • phpstan: $response initialised before the retry loop in OverpassApi::sendQuery() (false positive), and the intentional reads of the deprecated OverpassQueryOptions::$returnRaw are ignored by path.
  • eslint: query-builder-map.js reordered so helpers are defined before use, L declared as a global, prettier applied.

Docs

• README rewritten: what the module does and does not do, requirements, usage of execute(), getElements(), streaming with sink, and the exception contract as of #3618910.
• Presets, the Feeds submodule and drupal/feeds are left out until #3614000 and #3614002 land.

Bug fix

• SettingsForm: "Check API status" caught ClientException, but getStatus() throws OverpassApiException since #3618910, so a failed status request ended in an error page. It now shows the message.

Notes

• The ^10.3 floor is a support-policy change; nothing on 1.0.x needs 10.3 technically. It goes into the 1.0.0-beta5 release notes along with the https default.
• The dependency injection for the two forms was planned in #3630442. It is done here because the CI jobs this issue adds need it; #3630442 keeps lowering the retry defaults.
• Security advisory coverage is a project-page setting and is not part of this MR.

Commits

• 15900af Packaging: move UI dependencies to suggest, https endpoint, CI (tbcs)
• 9e8d1f3 Group with the OpenStreetMap modules, drop the broken sniff (tbcs)
• 35c8e00 Trim the docs and composer.json to what 1.0.x ships
• 3fc25a7 Fix the cspell and phpcs findings
• e968a1c Fix the phpcs errors coder 8.3 reports
• 1de64e1 Inject services into SettingsForm and QueryBuilderForm
• 107d2f7 Clear the remaining phpstan findings
• 3aeb21e Fix the eslint findings

Testing

• Pipeline #1006648: every job green, phpunit 77/77.
• Locally (DDEV, Drupal 11.4): both forms build and render through formBuilder()->getForm(), and QueryBuilderForm survives serialize/unserialize with its injected services.