Add Doctrine schema and voter assertions

[TavoNiievez]

What

Two assertions that have no equivalent in Symfony's own test traits, nor elsewhere in this module.

seeDoctrineSchemaIsValid() — DoctrineAssertionsTrait

In-process equivalent of bin/console doctrine:schema:validate. It fails on an invalid mapping, and on a database schema that has drifted from the metadata, so a forgotten migration surfaces as one clear failure instead of unrelated errors spread over the rest of the suite.

Guarded with class_exists(SchemaValidator::class). The entity manager checked is the one from the module's existing em_service option, so no second way of naming an entity manager is introduced.

seeUserIsGranted() / dontSeeUserIsGranted() — SecurityAssertionsTrait

Run the application's voters through Security::isGranted(), with an optional subject:

$I->seeUserIsGranted('POST_EDIT', $post);
$I->dontSeeUserIsGranted('POST_DELETE', $post);

seeUserHasRole() only covers attributes checked without a subject. Custom voters — the part of the authorization layer applications actually write — were reachable only through a full HTTP round trip and a 403 assertion.

Tests

tests/_app gains a UserVoter fixture. It implements VoterInterface instead of extending Voter, whose abstract voteOnAttribute() signature gained a Vote argument in Symfony 8.1 and is therefore not compatible across every supported Symfony version.

Functional coverage against a real Symfony application follows in Codeception/symfony-module-tests.

Scope

An earlier revision of this branch also proposed a new EnvironmentAssertionsTrait and a further set of Doctrine, Security and Session assertions. Those have been dropped:

• Environment and infrastructure checks — seeAppCacheIsWritable, seeAppLogIsWritable, seeProjectStructureIsSane, seeEnvFileIsSynchronized, seeAssetManifestExists, seeDoctrineProxyDirIsWritable, seeSessionSavePathIsWritable, seeDoctrineDatabaseIsUp — describe the machine the application runs on rather than the application. They belong in CI or a healthcheck. If the cache directory is not writable the kernel does not boot; if the database is down every database-touching test already fails.
• Container-parameter wrappers — seeKernelEnvironmentIs, seeDebugModeEnabled, dontSeeDebugModeEnabled, seeKernelCharsetIs, seeBundleIsEnabled, seeFirewallIsConfigured, seeRoleInHierarchy — are one grabParameter() call plus a plain assertion (kernel.environment, kernel.debug, kernel.charset, kernel.bundles, security.firewalls, security.role_hierarchy.roles).
• seeSymfonyVersion() is a version guard rather than an assertion, and Kernel::VERSION is public.
• seeAppEnvAndDebugMatchKernel() and seeEnvFileIsSynchronized() passed vacuously when the variables or the example file were absent.
• seeSecretCanBeResolved() could not pass at all: ContainerBag::get('env(resolve:NAME)') resolves to Container::getParameter(), and env(...) parameter names exist only at compile time, so every call ended in the catch block and failed. resolve: is also the wrong processor for a vault secret, which is read as a plain %env(NAME)%.

Three of the dropped methods called markTestSkipped() from inside an assertion, which would have been the first occurrence in src/: a helper that skips the caller's whole test hides failures rather than reporting them.

CONTRIBUTING.md records the see* / assert* naming convention together with both scope rules, so the same ground does not have to be re-argued on the next assertions PR.

Notes

Based on main after #247.

[ThomasLandauer]

This PR replaces #218