Stop mirroring core's config.platform into the Composer overlay.

[amateescu]

The Issue

• Alternative approach for feat: propagate config.platform from core's composer.json #24

How This PR Solves The Issue

#24 set out to make PHPStan analyse against the PHP version core declares rather than the container's runtime version. That part was right, and it still works after this change. The mechanism was the problem.

The plugin merged core's config.platform into Composer's runtime config and wrote it into composer.local.json on every invocation. A platform in the root composer file constrains the solver and install-time checks for the whole overlay, not just core, so:

• Any overlay package requiring a newer PHP than core's declared minimum becomes uninstallable, even though the container runs a newer PHP.
• A lock solved without the mirror stops satisfying it, so ddev composer install fails on packages already in the lock.
• The value cannot be removed by hand, because the next Composer run writes it back.
• Keeping the lock's content hash consistent needed a reflection hack, since writing to the root file during plugin activation changed the hash behind the Locker's back.

PHPStan reads config.platform from whatever file $COMPOSER points at, which is why the overlay needed the value. Pointing PHPStan at core's composer.json instead gets the same result with no effect on Composer:

$ ddev phpstan -vvv core/lib/Drupal/Core/Entity/EntityInterface.php
PHP runtime version: 8.5.7
PHP version for analysis: 8.3 (from config.platform.php in composer.json)

So commands/web/phpstan and commands/web/commit-code-check export COMPOSER=composer.json, and the platform merge, the file sync and the lock-hash hack are gone.

Existing projects have the mirrored value sitting in composer.local.json, and would stay wedged after upgrading, so the plugin removes it on the next Composer run and says why. It only removes a value identical to core's, so a platform someone set deliberately is left alone. The lock also recorded it as platform-overrides, which install honours, so the message points at ddev composer update.