Security: Remove exposed validation-token test endpoint

`ValidationTokenController::testGenerateToken()` exposed a route that minted a
valid `ValidationToken` for any resource id with no authorization check, so any
caller could forge tokens and drive the privileged validation actions they gate
(e.g. unsubscribing arbitrary users from tickets).

The method was a test-only helper, referenced nowhere and pointing at a route
name that no longer exists, so it is removed entirely along with its now-unused
`UrlGeneratorInterface` import. Token issuance remains confined to the
authorized `ValidationTokenHelper` flow.

Refs GHSA-9g35-w847-rpp8

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: AngelFQC

src/CoreBundle/Controller/ValidationTokenController.php

@@ -19,7 +19,6 @@
 use Symfony\Component\HttpFoundation\RequestStack;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Attribute\Route;
-use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
 use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
 
 #[Route('/validate')]
@@ -71,21 +70,6 @@ public function validate(string $type, string $hash): Response
         ]);
     }
 
-    #[Route('/test/generate-token/{type}/{resourceId}', name: 'test_generate_token')]
-    public function testGenerateToken(string $type, int $resourceId): Response
-    {
-        $typeId = $this->validationTokenHelper->getTypeId($type);
-        $token = new ValidationToken($typeId, $resourceId);
-        $this->tokenRepository->save($token, true);
-
-        $validationLink = $this->generateUrl('validate_token', [
-            'type' => $type,
-            'hash' => $token->getHash(),
-        ], UrlGeneratorInterface::ABSOLUTE_URL);
-
-        return new Response("Generated token: {$token->getHash()}<br>Validation link: <a href='{$validationLink}'>{$validationLink}</a>");
-    }
-
     /**
      * Processes the action associated with the given token type.
      */