Extract ComposerIntrospector to deduplicate vendor dir and composer.json handling

[janedbal]

Follow-up to #397, which added a third identical copy of the "single registered vendor dir" autodetection snippet and a second copy of the composer.json read + decode block.

Changes

• New ShipMonk\PHPStan\DeadCode\Composer\ComposerIntrospector service (registered in rules.neon) with:
  • autodetectVendorDir() — the shared ClassLoader::getRegisteredLoaders() / phar-filter / single-loader logic
  • autodetectComposerJsonPath() — vendorDir/../composer.json + is_file check
  • parseComposerJson() — read + json_decode + error handling
• TestsUsageExcluder, ComposerUsageProvider and SymfonyUsageProvider now inject it instead of carrying private copies (Symfony only needs autodetectVendorDir() for its ../config derivation).
• TestsUsageExcluder::extractAutoloadPaths() now takes mixed and validates the structure itself, since the shared parseComposerJson() no longer pretends to know the autoload-dev shape via a PhpDoc array shape.

No behavior change for any composer.json that composer itself accepts; the only difference is that a few degenerate inputs (scalar top-level JSON, malformed autoload-dev shapes) which previously crashed TestsUsageExcluder with a TypeError now degrade to "no dev paths detected". VendorUsageProvider is intentionally untouched as it needs all vendor dirs including the phar one.

Co-Authored-By: Claude Code