Add secure defaults checklist and CI linting

[hyperpolymath]

• Add SECURE_DEFAULTS.md with comprehensive security checklist covering:

  • PHP configuration best practices
  • Input validation patterns with php-aegis Validator
  • Output sanitization with php-aegis Sanitizer
  • HTTP security headers configuration
  • Authentication, database, file, and crypto guidelines
  • CI/CD and dependency management practices

• Add phpstan.neon with maximum strictness (level 9)

  • Enable all strict type checks
  • Check for implicit mixed types
  • Report maybes in method signatures

• Add .php-cs-fixer.dist.php with PSR-12 and security rules

  • Enforce strict_types declaration
  • Enable strict comparisons
  • Warn on eval() usage
  • Migrate to secure random functions

• Add php-lint.yml CI workflow with comprehensive checks:

  • PHP syntax validation
  • PHP-CS-Fixer code style enforcement
  • PHPStan level 9 static analysis
  • SPDX license header verification
  • strict_types declaration check
  • Security pattern detection (dangerous functions, weak crypto)
  • Composer dependency audit
  • PHP 8.1-8.4 compatibility matrix

• Update .gitignore for PHP tooling cache files