[Master] Update Github Actions and PHP dependencies

[pitbulk]

• Update Checkout to 4.x

• Security improvements:

  • Explicit minimal permissions (least privilege)
  • Actions pinned to commit SHAs (supply-chain protection)
  • Runner OS pinned (reproducibility)
  • PHP versions quoted as strings (YAML float-safe)
  • Job timeout set (cost/runaway protection)
  • Step ordering: checkout before setup-php
  • Removed non-deterministic composer self-update

  Fix PHP dependencies:

"php-coveralls/php-coveralls": "^1.0.2",
"sebastian/phpcpd": "^2.0 || ^3.0",
"phploc/phploc": "^2.1 || ^3.0 || ^4.0",
"pdepend/pdepend" : "^2.5.0",