feat: init mcvs-php-action

[Joeri-Abbo]

Description

Initial version of mcvs-php-action, the PHP counterpart of
mcvs-golang-action. It
deliberately mirrors that repository its layout, naming and workflows.

It ships two entry points:

• action.yml — a composite GitHub Action for CI/CD pipelines.
• build/task.yml — a reusable Taskfile that is included
  remotely by consuming projects and that holds every task the action runs.

What it covers

The testing-type input selects the workflow: component, composer-validate,
coverage, e2e, integration, lint, mess-detection, rector,
security-composer-packages, security-grype, static-analysis and unit.
Optionally a PHAR is compiled and uploaded on tagged releases.

Notable design decisions

• PHP version detection — derived from composer.json, where
  config.platform.php takes precedence over the normalised require.php
  constraint, so that CI runs the version the project declares. The
  php-version input overrules both.
• Tool installation — PHP has no go install equivalent, so every tool is
  downloaded as a pinned PHAR into ${MCVS_PHP_ACTION_BIN}, leaving the
  composer dependencies of the consuming project untouched. PHPUnit and Rector
  are the exceptions and resolve to vendor/bin.
• Test selection — Go build tags have no PHP equivalent, so tests are split
  over PHPUnit testsuites, with TEST_GROUPS mapping onto --group for further
  narrowing.
• Timeouts — PHPUnit has no global timeout option, so its invocation is
  wrapped in timeout.
• Coverage — CODE_COVERAGE_STRICT also fails the build when the actual
  coverage exceeds the expected coverage, forcing the threshold to be raised.

Guardrails

Three workflows enforce the conventions of this repository: sorted inputs in
action.yml, sorted task keys in build/task.yml and no empty lines in
build/task.yml. Tool versions are bumped weekly by
package-version-updater.

Testing

This repository uses itself for CI, see
.github/workflows/php.yml. As it holds no PHP code,
only the language agnostic testing types run: composer-validate,
security-composer-packages and security-grype.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[sbp-bvanb]

Missing the version comments.