fix: #3599849 Address unsafe usage of new static()

Ben Stallingsrequested to merge
issue/simple_oauth-3599849:3599849-address-unsafe-usage into 6.1.x

Replace unsafe new static() calls flagged by Upgrade Status:

  • Autowire controllers extending ControllerBase (drop create(), promote constructor properties, #[Autowire] for named services).
  • Use new self() in leaf forms, plugins, adapters and validators.
  • Mark ScopeProviderBase::__construct() final so its inherited new static() factory stays safe while preserving late static binding for the empty scope provider subclasses.

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

Closes #3599849

Merge request reports