[POLICY] Adopt a minimum PHP 7 version stricter than core

Problem/Motivation

Drupal 8 supports older versions of PHP 7, primarily because some distributions (e.g., Ubuntu) provide LTS security coverage for PHP longer than the core PHP maintainers. Currently, the minimum version supported is 7.0.8, and Commerce de facto inherits that constraint.

Because of core's broader span of supported PHP versions, we are effectively unable to adopt certain new language constructs and features. E.g., this CI job failed because nullable parameters were only introduced in PHP 7.1.

Drupal Commerce is one of the most progressive contrib ecosystems in terms of code style, however core's limitations effectively pin us at 7.0. This is in addition to being end of life.

While this would be a disruptive change for some, running a supported PHP version is much less difficult than it used to be; most all commodity hosting platforms used the EOL of PHP 5 to get on a more aggressive upgrade schedule. Acquia, for instance, automatically upgrades customer instances.

Furthermore, the majority of sites with Drupal Commerce 2.x have some type of PCI compliance burden, even if it is simply A/A-EP. This standard still requires security patches be applied as available (section 6.2(a)).

Proposed resolution

Add a version constraint in Commerce's composer.json to match the minimum supported minor version of PHP (currently ^7.2).

This would effectively require other installed contrib modules to be compatible, however there are no breaking changes between minor versions of PHP 7, so this is a minor concern. Basically, we lose nothing by raising the bar but miss out on higher-quality, safer and more resilient code constructs by waiting for core.

Remaining tasks

Change record.