Upgrade guzzle & psr7 out of CVE-affected versions; pin dev dependencies

[jplcodes]

Two related dependency-hygiene changes.

1. Upgrade guzzle & psr7 out of CVE-affected versions

Bumps two transitive dev dependencies out of versions flagged by composer audit:

Package	From	To
guzzlehttp/guzzle	7.11.1	7.13.2
guzzlehttp/psr7	2.11.0	2.12.3
symfony/deprecation-contracts	v3.7.0	v3.7.1 (incidental, resolver)

Advisories cleared:

• guzzlehttp/guzzle < 7.12.1 — CVE-2026-55767 (dot-only cookie domains match all hosts) & CVE-2026-55568 (silent HTTPS proxy downgrade to cleartext)
• guzzlehttp/psr7 < 2.12.1 — CVE-2026-55766 (CRLF injection in HTTP start-line serialization)

2. Pin dev dependencies to exact installed versions

Locks the direct dev dependencies so composer update cannot move them:

"orchestra/testbench": "^10.0"  ->  "10.11.0"
"pestphp/pest":        "^3.7"   ->  "3.8.6"
"phpstan/phpstan":     "^2.1"   ->  "2.2.2"

Production require (php: ^8.3) is unchanged.

Notes

• Both packages in change Added custom exceptions #1 are pulled in transitively via laravel/framework -> orchestra/testbench; there is no production require on guzzle, so this is a lockfile + dev-constraint change only.
• guzzle stays in the 7.x line (Laravel constraint ^7.8.2 satisfied).

Verification

• composer audit → No security vulnerability advisories found
• composer validate → valid
• vendor/bin/pest → 143 passed (144 assertions)
• vendor/bin/phpstan --memory-limit=1G → No errors