[TASK] Fix failing quality gates on main

[sbuerk]

Fixes both quality gates that currently fail on main, independent of any
pending pull request. Both failures reproduce on a plain main checkout.

[BUGFIX] Pass JSON_THROW_ON_ERROR as flags

ComposerPackageManager::getPackageComposerJson() passed JSON_THROW_ON_ERROR
as the third argument of json_decode(), which is $depth, leaving $flags at
0. The flag never took effect, the surrounding try/catch was dead code, and
$depth was set to 4194304. Observable behaviour does not change, since
json_decode() returns null for invalid input, which already matched the
intended null fallback.

PHPStan 2.2 reports this as argument.invalidConstant. As composer.lock is not
part of the repository, CI resolves the latest PHPStan release, which turned a
long-standing defect into a failing gate on the PHP 8.2 and 8.3 jobs.

[TASK] Declare v15 package metadata in fixtures

TYPO3 v15 no longer evaluates ext_emconf.php and requires extensions to declare
the extension version and the providesPackages definition in the
extra/typo3/cms section of composer.json, see deprecation #108345. Extensions
missing that metadata make the core PackageManager throw an
InvalidPackageManifestException:

InvalidPackageManifestException: The composer.json of extension "package2" must
declare the extension version and the "providesPackages" definition in the
"extra/typo3/cms" section.

Only the PHP 8.5 job hits this, because typo3/cms-core dev-main requires
php: ^8.5; the 8.2, 8.3 and 8.4 jobs resolve to 14.3.x-dev.

The fixture composer.json files now declare version and an empty
providesPackages object. That metadata also marks an extension as "composer
only capable" for core v14 (PackageManager::isComposerOnlyCapable()), which
stops merging ext_emconf.php into the manifest there as well. Both supported
core versions therefore resolve package constraints from composer.json only and
provide the same loading order, so no core-version-aware expectations are needed.

The expected order changes accordingly: the "unsynced" fixtures declare a
dependency in ext_emconf.php that is not present in their composer.json, and
that dependency is no longer taken into account. extension_unsynced_extemconf
and extension2_unsynced_extemconf swap positions. The IgnoreDeprecations
attribute is dropped, as the fixtures no longer trigger the ext_emconf.php
deprecation on core v14.

Test results

Full ci.yml matrix executed locally, cgl and phpstan only for PHP <= 8.3 as
in CI:

PHP	resolved core	composerUpdate	cgl	phpstan	lint	unit
8.2	14.3.x-dev	OK	OK	OK	OK	OK
8.3	14.3.x-dev	OK	OK	OK	OK	OK
8.4	14.3.x-dev	OK	-	-	OK	OK
8.5	dev-main (v15)	OK	-	-	OK	OK

Follow-ups, not part of this pull request

• The PackageCollection class docblock still describes ext_emconf.php as the
  classic mode source of truth with a composer.json fallback, which is inverted
  now. The @todo in PackageCollection::fromPackageStates() is effectively
  answered by core v15.
• Resources/Core/Functional/Extensions/{json_response,private_container} still
  require typo3/cms-core: 13.*.*@dev || 14.*.*@dev while main targets v14 and
  v15. Both already declare the package metadata needed for v15.
• Test extensions of testing framework consumers that lack the package metadata
  will hard-fail on core v15 instead of degrading. Worth a release note for the
  next 10.x tag.