Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@Dockerfile`:
- Around line 144-145: The Dockerfile currently downloads php-cs-fixer directly
from cs.symfony.com without pinning or verifying integrity; change the RUN that
fetches php-cs-fixer to download a specific release from GitHub (use a pinned
version tag/ARG like PHP_CS_FIXER_VERSION and the matching release asset URL
instead of cs.symfony.com) and add SHA256 verification before making the file
executable (e.g., fetch or set the expected SHA256 value and run a sha256sum -c
check against the downloaded /usr/local/bin/php-cs-fixer, failing the build if
verification fails), then chmod +x only after the checksum passes. Ensure the
instructions reference the php-cs-fixer binary path
(/usr/local/bin/php-cs-fixer) and the RUN step that currently performs the curl
and chmod.
- Line 147: Replace the caret version constraints used in the Dockerfile
composer global install step so the build is reproducible: change the composer
invocation that sets COMPOSER_HOME=/opt/composer and runs "composer global
require ... squizlabs/php_codesniffer:^3 phpstan/phpstan:^2" to use exact
version pins for squizlabs/php_codesniffer and phpstan/phpstan (refer to the
COMPOSER_HOME line and the composer global require invocation), updating the
package versions to the chosen exact releases (e.g., 3.x.y and 2.x.y) and
keeping the --no-interaction/--no-progress flags unchanged.