ci: bypass setup-php auto-written composer auth (workaround for malformed token)

Recent CI runs hit "Your github oauth token for github.com contains invalid
characters" intermittently — once on PHP 8.5/master (eb53350), once on PHP 7.4
on the refactor branch (5843b6e). Same error, different PHP version each time.

Root cause: shivammathur/setup-php@v2 writes ~/.composer/auth.json with
$GITHUB_TOKEN by default. GitHub Actions has been occasionally returning that
token with embedded newlines (visible in the log as multiline `***` mask),
which composer 2.10 rejects with the error above.

Fix: in the Linux install step, drop the auto-written auth.json and set
COMPOSER_AUTH='{}' so composer runs without a token. Our deps are all public
(packagist) so no auth is needed. Windows uses the system composer with a
different env so it has not hit this; leaving it untouched.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Test

.github/workflows/ci.yml

@@ -80,7 +80,15 @@ jobs:
 
       - name: Install dependencies (Linux)
         if: runner.os == 'Linux'
+        env:
+          # setup-php@v2 writes ~/.composer/auth.json with $GITHUB_TOKEN by
+          # default. Recently that token has been occasionally malformed
+          # (newlines embedded), causing composer to fail with "github oauth
+          # token contains invalid characters". Our deps are all public, so
+          # we drop the auto-written auth before install.
+          COMPOSER_AUTH: '{}'
         run: |
+          rm -f ~/.composer/auth.json ~/.config/composer/auth.json
           chmod -R +x tools/*
           tools/composer install --prefer-dist --no-progress