Lint PHP and report Composer package changes in CI

[tomjn]

Adds a basic linting action for PHPCS

This PR also turns hm-linter off for this repository, because per-repository Actions are now preferred. The workflow covers everything hm-linter checked here, except annotations on fork PRs and linting branches that have no PR.¹

Footnotes

1. What hm-linter covered, and what replaces it:

   • PHPCS with the HM standards and phpcs.ruleset.xml: the Linting workflow runs it with the same ruleset.
   • ESLint and stylelint: the repo has no .js or .css files, so nothing is lost. The CSS in inc/admin-bar.php is a PHP string, which hm-linter never checked. If the plugin gains front-end assets, add both to the workflow.
   • Annotated check run on PRs: lint-action posts one for PRs from this repository. Fork PRs run composer lint instead, so the check still passes or fails, but errors appear only in the job log.
   • Pushes to any branch: the workflow runs on PRs and pushes to master only. A branch with no PR gets no lint.
   • Standards version: hm-linter used the latest HM standards. The workflow uses the version in composer.lock, so CI matches a local composer lint, and new rules arrive through dependency updates.
   • First-install issue listing existing errors: not needed, because master lints clean.

   .github/hmlinter.yml disables all three hm-linter checks. The app stays installed at org level. ↩

[svandragt]

Lint now runs and passes. Two problems needed fixing before this could merge:

• PRs from forks get a read-only token. lint-action can't create its check run, and the sticky comment can't post, so both jobs fail on fork PRs whatever the code looks like.
• If a later push reverts composer.lock, the old package-change comment stays on the PR.

I've pushed fixes for both. Fork PRs now run composer lint without the check run annotations.

This workflow also replaces hmlinter: we now prefer a per-repo GitHub Action over hm-linter. This PR adds .github/hmlinter.yml to turn hm-linter off for this repo, so each PR gets one PHPCS report.

[svandragt]

@tomjn I've picked this up. Changes since your last commit:

• The Linting workflow now runs on pull requests and pushes to master. It only had workflow_call before, so it never ran.
• phpcs is on PATH and uses phpcs.ruleset.xml. lint-action calls a bare phpcs, so the first run failed with "PHP_CodeSniffer is not installed".
• Lint runs on PHP 8.2. The coding standards update in Fix the WPCS code execution advisory and require PHP 8.2 #31 (Fix the WPCS code execution advisory and require PHP 8.2) needs it.
• Every action is SHA-pinned at its latest release, including setup-php.
• Fork PRs run composer lint and skip the PR comment, because their token is read-only.
• The Composer diff comment is deleted when a later push leaves no package changes.
• .github/hmlinter.yml turns hm-linter off, so each PR gets one PHPCS report.

CI is green. This should merge before #31.