Security status checks will stop running in Drupal 13: move hook_requirements() to hook_runtime_requirements()

Problem/Motivation

File Gate reports two security findings on the status report from file_gate_requirements() in file_gate.install:

• a gated field that stores files on a public file system, so the gate never runs;
• a named secret that has a value but no field scope, so it can authenticate and mint nothing.

Drupal 11.3 replaced the procedural hook with hook_runtime_requirements(), hook_update_requirements() and an install-time class. Core now logs this on every container rebuild:

file_gate_requirements without a #[LegacyRequirementsHook] attribute is deprecated in drupal:11.3.0 and removed in drupal:13.0.0. See https://www.drupal.org/node/3549685

The notice is the small part. Drupal 13 stops calling the procedural hook, and nothing fails when that happens: the two findings leave the status report and the site reads as healthy. A check that guards a security boundary should not be able to disappear without an error.

The module's tests would not catch it. They call file_gate_requirements('runtime') directly, so they pass whether or not core ever invokes the function.

Steps to reproduce

1. Install File Gate 1.9.2 on Drupal 11.4.
2. Rebuild the container, or run any kernel test that enables the module, with deprecations shown.
3. The notice above is logged for file_gate_requirements.

Proposed resolution

The module already requires Drupal 11.4, so it does not need the legacy attribute or a transition period.

• Move both checks to a hook class that implements hook_runtime_requirements(), with the entity type manager and the secret registry injected.
• Remove file_gate_requirements(). It only ever acted in the runtime phase.
• Use RequirementSeverity::Error in place of the REQUIREMENT_ERROR constant, which is deprecated since 11.2.
• Change the tests to invoke the hook through the module handler, the way the status report does, so they fail if the hook stops being called.

Remaining tasks

• Patch and tests.
• Review.

User interface changes

None. The two status report rows keep their keys, titles, severity and text.

API changes

file_gate_requirements() is removed. It was a hook implementation, not a public API. Code that called it directly should invoke runtime_requirements through the module handler.

Data model changes

None.