Bump PHPStan to version 2.3.1

The Needs Review Queue Bot tested this issue. It fails the Drupal core commit checks. Therefore, this issue status is now "Needs work".

This does not mean that the patch necessarily needs to be re-rolled or the MR rebased. Read the Issue Summary, the issue tags and the latest discussion here to determine what needs to be done.

Consult the Drupal Contributor Guide to find step-by-step guides for working with issues.

Seems like an innocent enough update that didn't break anything in core.

Committed/pushed to main. Also to 12.0.x - I tried to cherry-pick, but this needed the baseline to be rebuilt locally, and then git cherry-pick --continue failed due to phpcs not finding any files, and doesn't have a --no-verify option, so went for a separate commit instead. I think there's already an issue open for phpcs failing on an empty file list.

We should probably backport this to 11.x too but better to have a fresh MR for that I think.

Sorry, had to roll this back because it introduced packaging fails on both branches. From @drumm:

> /usr/bin/php8.4 /usr/local/bin/composer --working-dir=/var/lib/subtree-splits/drupal/12.0.x/5fcebc1168ecb0d6c28d89b7cd02e524b3997d18/subtree-workdirs/legacy-project -n require --dev --no-security-blocking drupal/core-dev:12.0.x-dev drupal/core-dev-pinned:12.0.x-dev
./composer.json has been updated
Running composer update drupal/core-dev drupal/core-dev-pinned
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.
  Problem 1
    - Root composer.json requires drupal/core-dev 12.0.x-dev -> satisfiable by drupal/core-dev[12.0.x-dev].
    - Root composer.json requires drupal/core-dev-pinned 12.0.x-dev -> satisfiable by drupal/core-dev-pinned[12.0.x-dev].
    - drupal/core-dev 12.0.x-dev requires phpstan/phpstan-phpunit ^2.1.1 -> satisfiable by phpstan/phpstan-phpunit[2.1.1, 2.1.x-dev].
    - drupal/core-dev-pinned 12.0.x-dev requires phpstan/phpstan-phpunit 2.0.18 -> satisfiable by phpstan/phpstan-phpunit[2.0.18].
    - You can only install one version of a package, so only one of these can be installed: phpstan/phpstan-phpunit[2.0.18, 2.1.1, 2.1.x-dev].
Installation failed, reverting ./composer.json and ./composer.lock to their original content.

Re: #7 it's entirely possible. 12.0.x's initial packaging was also completely borked internally due to mismatch between the branch alias and release tagging utilities, and then after we made the branch-alias-related fix, it was broken a second way when it got to the metapackages. And 11.5.x had broken metapackages and was in a permanently broken state.

Edit: Alternatively there might have been some change in HEAD prior to 12.0.x specifically related to the metapackage... but either way, @godotislate reported the same thing IIRC.

Neil fixed 11.5.x by creating a custom packaging job to force regeneration of the packages. I wonder if that is also applicable to the initial packaging of 12.0.x, and therefore something that will bite us possibly not only in this issue but also for other dev dep updates.

I looped in infra in case they can fix 12.0.x the same way, but the issue described in #7 sounds more like an internal core problem. It would be good to check whether something changed it in main only.

I am pretty sure that d.o packaging depends on that metapackage....