chore: add static analysis (PHPCS + PHPStan) and CI

[YvesCesar]

The plugin had no composer.json, no linting and no CI — the only check was the DCO bot. This adds a static analysis setup and fixes what the first run reported.

Tooling

• composer.json — PHP >=8.1, dev dependencies only (PHPCS 3.13, WPCS 3.4, PHPCompatibilityWP, PHPStan 2.2 + phpstan-wordpress, WooCommerce stubs, parallel-lint) and the lint / cs / cs:fix / stan / ci scripts.
• phpcs.xml.dist — a lean ruleset rather than the full WordPress-Extra + WordPress-Docs. The files mix tabs and spaces, so running phpcbf over the whole standard would bury the history in a formatting diff. It enables only WordPress.Security, WordPress.DB, WordPress.WP.I18n, the deprecated/global-override sniffs, PrefixAllGlobals (prefixes libresign / LIBRESIGN) and PHPCompatibilityWP with testVersion 8.1-.
• phpstan.neon.dist — level 5, clean. The only ignoreErrors entry covers the wp-config.php salts (AUTH_KEY, SECURE_AUTH_SALT, NONCE_SALT), which PHPStan cannot see.
• .github/workflows/ci.yml — a single static job on PHP 8.3 running composer lint, cs and stan.

wc_clean is registered as a custom sanitizing function, otherwise PHPCS reports four false positives on code that already sanitizes correctly.

Findings fixed

The first PHPCS run reported 11 issues, all in libresign-wp-customizations.php:

• :205 the admin notice was echoed with interpolated variables and no escaping — now printf with esc_attr plus wp_kses_post, since the message intentionally carries an <a>.
• :234 wp_die( __( 'Você não tem permissão…' ) ) had no text domain, so the string was never translatable, and no escaping either.
• :621 $_SERVER['REQUEST_URI'] was only unslashed, never sanitized.
• :721 the FAQ link is built as HTML and was passed raw to printf.
• :788 and :832 $_GET['subscription_id'] and $_GET['libresign_confirm_subscription'] were passed straight into the lookup helper — now absint( wp_unslash( … ) ), which also clears the two NonceVerification warnings.

Verification

composer ci is green: no lint errors, no PHPCS violations, no PHPStan errors at level 5. The plugin still loads and stays active in the local stack.

[vitormattos]

Looks good now. The requested changes were addressed and the remaining CI improvements are tracked in #15 as a follow-up.