PHPBB-17684

Checklist:

• Correct branch: master for new features; 3.3.x for fixes
• Tests pass
• Code follows coding guidelines: master and 3.3.x
• Commit follows commit message format

Tracker ticket:

https://tracker.phpbb.com/browse/PHPBB-17684

• Added CSRF protection and hardened package/action validation against unauthorized package operations and remote code execution risks.
• Improved Composer operation locking, failure recovery, and manifest/lock-file restoration.
• Fixed repository priority handling so Packagist dependencies are not incorrectly shadowed by canonical phpBB repositories.
• Prevented extensions likely to fail dependency resolution from appearing as installable.
• Fixed compatible composer/installers v1/v2 constraints.
• Made the Extension Manager’s “Update” action appear only when a newer compatible version is actually available.
• Added explicit “Back to Extension Catalog” and “Back to Extension Manager” links to Composer success and error pages.
• Added a “Restore defaults” button for the standard phpBB Composer repository URLs.
• Made unavailable custom repositories gracefully fall back to Packagist when Packagist is enabled.
• Fixed unavailable-repository detection for Composer’s non-canonical FilterRepository wrappers.
• Added missing Composer error language strings and clearer repository warnings.