[ondrejmirtes]

Updates issue-bot dependencies in small steps, one commit per step:

1. Latest minor and patch versions of everything, including the security fixes for league/commonmark (2.10.4) and guzzlehttp/guzzle (7.16.1)
2. nette/utils 4, replacing the deprecated Json::FORCE_ARRAY with forceArrays: true
3. Require PHP 8.5 (and set the Composer platform to 8.5). issue-bot already needs 8.5 because it uses the pipe operator, and every workflow runs it on 8.5. nette/neon 4 and Symfony 8 need at least 8.4.
4. nette/neon 4. I checked that Neon::encode() writes the generated playground config byte-for-byte the same as 3.4.
5. symfony/console and symfony/finder 7.4, replacing the deprecated Application::add() with addCommand()
6. symfony/console and symfony/finder 8
7. PHPUnit 11, then 12
8. Require sebastian/diff ^7.0 directly. src/ and console.php use it, but it only arrived through PHPUnit.
9. guzzlehttp/guzzle 8

Not updated: PHPUnit 13. It requires sebastian/diff 9, which removed UnifiedDiffOutputBuilder and switched to a different diff algorithm. PostGenerator decides whether to comment again by comparing its diff with the diff in the bot's earlier comment. On random error lists, diff 9 produced a different diff for about 22% of the pairs that diff 7 handled, so the bot would post again on issues it already commented on.

Verification (PHP 8.5):

• vendor/bin/phpunit passes after every step (27 tests).
• ../bin/phpstan reports only the 3 RunCommand::runPool() errors that Build Issue Bot has reported on 2.3.x since September. They come from PHPStan 2.3.x-dev's own inference, not from these updates.
• Live smoke test with Guzzle 8: knplabs/github-api downloaded real issue comments, existing phpstan-bot comments were parsed, and PlaygroundClient fetched results from api.phpstan.org.
• The Issue bot workflow on this PR runs download, analyse and evaluate end to end with the new lock file.

Supersedes #6011, #3442, #6336 and #5920.

One expected change in bot output. The Issue bot run on this PR reports a changed result for phpstan/phpstan#11359 (mb_ucfirst): no errors on PHP 8.4–8.6, Function mb_ucfirst not found. on 7.2–8.3. On 2.3.x the bot reports no error on any version. The cause is symfony/polyfill-mbstring 1.37 → 1.43, which comes from the patch-level update in the first commit. bin/phpstan loads issue-bot's own vendor/autoload.php while it analyses playground snippets. The old polyfill declared mb_ucfirst in its bootstrap.php, where PHPStan found it for every PHP version. 1.43 moved those declarations to bootstrap72.php. I confirmed this locally by swapping only that package in the old vendor directory. The new result is the correct one, because mb_ucfirst exists only from PHP 8.4. Evaluating the same CI artifacts with the old and the new dependencies gives byte-identical output, so nothing else changes. After this is merged, the bot will post this one comment on #11359.