Hide released and expired bookings by default on the resource and slot booking lists

Closes [#3615677].

What changes

BookingsForm leaves released and expired lines out of the list unless asked for, on every scope except an order's own tab.

• A DROPPED_STATES constant naming the two, with the reasoning: a line reaches either only from held, and confirmed is reachable only through BookingManager::confirm(), so neither was ever confirmed. Where one had been paid — a placed order that gets rejected — the refund step runs before the release. Both are already outside CONSUMING_STATES and outside the record TransactionLookup::cancelledLines() returns, so this agrees with what the engine says they are worth.
• cancelled is deliberately not hidden: that is a booking that existed and was undone, which is the record of what an order was and the line an operator comes to this list for.
• An "Include released and expired" checkbox in the existing filter fieldset, defaulting off, so nothing becomes unreachable.
• The flag travels in the query (?dropped=1), so a page of the list, a bookmark and the return path from a bulk action all describe the same list. Only the states being asked for are written, so the usual URL stays clean.
• The condition goes in the query, not a filter over the result, or the pager would count rows it does not show and pages would come back short.
• An order's own tab is exempt: it is that order's history, and that branch carries no filter, so there would be nothing to switch them back on with.

Why it matters

Choosing seats on the map leaves a long tail of holds behind — one live order has been measured at 302 lines for a single consuming one — so a resource's or slot's list arrives with the real bookings buried in lines that never became bookings and that nothing reads.

Tests

New case in BookingsTabTest: a two-line order with one line released shows one row on the slot tab and on the resource tab, both rows with ?dropped=1, and both rows on the order's own tab with no checkbox. Run in the served test docroot: BookingsTabTest + BookingActionsTest, 4 tests, 71 assertions, green.

The first run failed and was worth having: it asserted the word "released" was absent from the page, which my own checkbox label puts there. The assertions are now scoped to the table.

phpcs, phpstan and cspell clean on both changed files.

Also in this MR

The filter is now a collapsed details with the chip bar the order, booking and slot collections already use through FilterFormBase, instead of an always-open fieldset. Always closed, as that base has it — the chips above are what say a filter is active, so opening the details would only push the list down to repeat them. Adjacent to the checkbox this MR adds, so it is here rather than in an issue of its own.

Re-run after that change: BookingsTabTest + BookingActionsTest, 4 tests, 75 assertions, green, in the served test docroot.