CI: run PHPStan via shivammathur/setup-php tool, not php-actions/phpstan

php-actions/phpstan@v3 defaults to version=composer and expects phpstan
in the project's dev-deps. We don't pull phpstan in via composer, so the
job errored with 'Trying to use version installed by Composer, but there
is no file at'. Switch to installing phpstan 1.12 via shivammathur/setup-php
tools and invoke it directly with -a vendor/autoload.php so it can resolve
Defuse classes.

Author: ericmann

.github/workflows/ci.yml

@@ -61,14 +61,10 @@ jobs:
         uses: shivammathur/setup-php@v2
         with:
           php-version: '8.3'
-          tools: composer:v2
+          tools: composer:v2, phpstan:1.12
 
       - name: Install dependencies
         run: composer install --prefer-dist --no-progress --no-interaction
 
       - name: PHPStan Static Analysis
-        uses: php-actions/phpstan@v3
-        with:
-          path: php/
-          php_version: 8.3
-          level: 2
+        run: phpstan analyse php/ --level=2 --no-progress -a vendor/autoload.php