Changes proposed in this Pull Request

• Fix CI failure caused by Composer's security audit blocking PHPUnit 4.x–9.x due to advisory PKSA-z3gr-8qht-p93v (CVE-2026-24765). Pin phpunit/phpunit to ^9.6 which resolves to 9.6.34 - a patched version outside the advisory's affected range
• Upgrade yoast/phpunit-polyfills from ^1.0.1 to ^2.0.
• Drop EOL PHP versions (7.2, 7.3) and outdated WordPress versions (5.2, 5.4, 5.7) from the test matrix. The minimum tested combination is now PHP 7.4 / WP 6.2.
• Simplify the test matrix from ~14 jobs down to 3 (PHP 7.4 + WP 6.2, PHP 8.2 + latest, PHP 8.4 + latest), covering the low end, middle, and high end of supported versions.
• Simplify the GitHub Actions test workflow by removing the 4-type Composer install branching logic that was only needed for WP < 5.9 compatibility. A single ramsey/composer-install step with dependency-versions: highest now handles all matrix entries.
• Simplify the MySQL service to always use MySQL 8.0, removing the conditional 5.6/5.7 image selection.
• Fix the PHPCS workflow: remove redundant composer require step (packages already in composer.json), upgrade PHP from 7.4 to 8.3, update action versions, and fix cs2pr XML parsing by adding the -q flag.
• Narrow CI triggers to only run on pushes to trunk and on pull requests (previously ran on all pushes to any branch).
• Update phpunit.xml.dist to remove deprecated PHPUnit 10-incompatible attributes (convertErrorsToExceptions, convertNoticesToExceptions, convertWarningsToExceptions).

Testing instructions

• Verify all 3 test matrix jobs pass in CI (PHP 7.4 / WP 6.2, PHP 8.2 / WP latest, PHP 8.4 / WP latest).
• Verify the PHPCS workflow passes.
• Confirm composer install resolves locally without errors or security advisory warnings.