CI: Fix old PHPUnit

[staabm]

recently CVEs for PHPUnit have been released, which are not fixed for old-phpunit.

The advisory is PKSA-5jz8-6tcw-pbk4, affected versions >=13.0.0,<=13.1.5|<=12.5.21. That covers every 9.x, 10.x, 11.x, and 12.x up to 12.5.21 - so no 9.x fix exists. Only 12.5.22+ / 13.1.6+ are safe.

see https://github.com/phpstan/phpstan-src/actions/runs/24599331208/job/71935200063?pr=5478

Running composer update phpbench/phpbench phpunit/phpunit brianium/paratest symfony/console symfony/process doctrine/instantiator --with-dependencies
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires phpunit/phpunit ^9.6, found phpunit/phpunit[9.6.0, ..., 9.6.34] but these were not loaded, because they are affected by security advisories ("PKSA-5jz8-6tcw-pbk4", "PKSA-z3gr-8qht-p93v"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.
  Problem 2
    - Root composer.json requires brianium/paratest ^6.5 -> satisfiable by brianium/paratest[v6.5.0, ..., v6.11.1].
    - brianium/paratest[v6.9.1, ..., v6.11.1] require phpunit/phpunit ^9.6.4 -> found phpunit/phpunit[9.6.4, ..., 9.6.34] but these were not loaded, because they are affected by security advisories ("PKSA-5jz8-6tcw-pbk4", "PKSA-z3gr-8qht-p93v"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.

[ondrejmirtes]

Why? What's failing?

[ondrejmirtes]

I'd say it's very dangerous to "fix" it like that. I'd rather have an exception for these specific CVEs and make sure to remove it once it's fixed again.

[staabm]

see https://github.com/phpstan/phpstan-src/actions/runs/24599331208/job/71935200063?pr=5478

[staabm]

The advisory is PKSA-5jz8-6tcw-pbk4, affected versions >=13.0.0,<=13.1.5|<=12.5.21. That covers every 9.x, 10.x, 11.x, and 12.x up to 12.5.21 - so no 9.x fix exists. Only 12.5.22+ / 13.1.6+ are safe.

[ondrejmirtes]

And now revert it please.

context https://phpc.social/@sebastian/116424686237276260