feat: support symfony 8, scheb 2fa 8 and sylius 2.3

[jeromeengeln]

Closes #17

What

Makes the plugin installable and tested on Sylius 2.3 / Symfony 8 / scheb/2fa-bundle 8, while keeping Symfony 7.4 and Scheb 7 working.

Changes

• composer.json
  • PHP ^8.3.
  • scheb/2fa-bundle, scheb/2fa-email and scheb/2fa-google-authenticator are now ^7.13 || ^8.0. Composer refuses a mix of Scheb majors.
  • endroid/qr-code-bundle is now ^6.0 || ^7.0.
  • extra.symfony.require is now ^7.4 || ^8.0.
  • sylius/test-application is now ^2.3.0@alpha.
  • The symfony/* dev packages are widened to ^7.4 || ^8.0.
• Services: config/services*.xml are converted to YAML and YamlFileLoader is used in the extension, because XmlFileLoader was removed in Symfony 8. I compared the resulting
  container definitions before and after, and they are identical.
• Return types: getSubscribedEvents(): array and VerificationCodeType::buildForm(): void, which are mandatory in Symfony 8.
• Dev dependencies
  • Removed the unused Behat/Mink stack (behat, mink*, dmore/, friends-of-behat/, robertfausk/*, suite-tags-extension). None of it has Symfony 8 support, features/ is empty and
    CI doesn't run Behat. behat.yml.dist is left untouched.
    CI doesn't run Behat. behat.yml.dist is left untouched.
  • madewithlove/license-checker is now ^2.1 || ^3.0, with a new .license-checker.yml for 3.x. The .allowed-licenses file stays for 2.x.
• CI: matrix PHP 8.3/8.4 × Symfony 7.4/8.0 × lowest/highest (Symfony 8 excluded on PHP 8.3), with fail-fast: false.
• Docs: README requirements, a 0.3.0 CHANGELOG entry and UPGRADE notes.

Breaking / upgrade notes

• The minimum PHP version is now 8.3 (8.4 when using Symfony 8 or Scheb 8).
• Scheb 8 changes the 2FA authenticator priority from 0 to -100. Check custom authenticators on the admin/shop firewalls. This is noted in UPGRADE.md.

Testing

Run locally on PHP 8.4.1 (check-license, cs-check, cs-twig, analyze and test, with the 56 existing tests):

Symfony	Dependencies	Resolved	Result
7.4	highest	Scheb 8.6.1	all green
7.4	lowest	Scheb 7.13.0	all green
8.0	lowest	Scheb 8.0.0	all green
8.x	highest	Symfony 8.1.8, Scheb 8.6.1	all green

Not verified locally

• PHP 8.3 cells: only PHP 8.4 was available locally, so CI will cover them.
• No end-to-end run of the test application. I only checked statically that the Scheb 8 service IDs and the scheb_two_factor.authentication.attempt event used by the plugin still
  exist. I'd appreciate a manual check of the admin/shop 2FA login flow (the -100 priority).

[crydotsnake]

I tested the 2auth admin/shop flow locally in the test application. Everything was working fine for me!