feat(variance)!: adopt Kotlin-style out/in variance markers

[math3usmartins]

Summary

Replaces the Scala/Hack-style declaration-site variance markers +T (covariant) /
-T (contravariant) with the Kotlin/C#-style out T / in T, aligning xphp's
surface syntax with the spelling chosen for PHP's generics. This is a hard swap:
+T / -T are no longer accepted.

// before
class Producer<+T> { /* … */ }
class Consumer<-T> { /* … */ }

// after
class Producer<out T> { /* … */ }
class Consumer<in T> { /* … */ }

Variance semantics are unchanged — the subtyping lift, position validation, edge
emission, and registry are identical. Only the surface spelling and the diagnostic
wording move; emitted PHP is byte-for-byte the same.

Details

• Contextual keywords. out / in act as a marker only when immediately followed
  by the parameter name (out T, never outT). Ordinary parameters whose names merely
  start with those letters (outer, input, outT) are unaffected.
• Reserved names. out / in cannot themselves name a type parameter, so
  class Box<out>, class Box<out out>, and class Pair<in, out> fail with a single
  clear diagnostic.
• Migration error. Old +T / -T source now raises an explicit error pointing at
  the new spelling instead of an opaque downstream parse failure.
• Diagnostics (xphp.variance_position, unprovable-edge warnings, inner-variance
  composition) now render out T / in T to match what the user wrote.
• Method/function/closure/arrow variance stays rejected (unchanged, message updated).