build(deps-dev): bump squizlabs/php_codesniffer to 3.13.6 (CVE-2026-67434) Clears the Dependabot alert for GHSA-hmqg-cxww-wqhq. PHP_CodeSniffer before 3.13.6 is vulnerable to command injection in the Gitblame, Hgblame and Svnblame reports when a scanned filename contains shell metacharacters (CWE-78, CVSS 4.0 7.3). Exposure in this repo was nil: php_codesniffer is a dev-only dependency, none of its code ships in the released package, and neither CI nor .phpcs.xml uses any of the affected *blame reports. Bumping anyway so the advisory is closed at the source. Verified on 3.13.6: phpcs clean over 52 files, full suite green (1889 tests, 4359 assertions), composer audit reports no advisories.