[8.0] Quality & DX improvements across the bundle

[wtorsi]

Summary

• Modern PHP: Add ImageFormat and ImagineDriver backed string enums, replace hardcoded constants; add #[Override] attributes to all interface/parent method implementations (~22 files)
• HTTP caching: Switch redirects from 301 to 302 for correct cache invalidation semantics
• Cache optimization: Add resolveIfStored() to ResolverInterface and all implementations, eliminating double cache lookups and TOCTOU race conditions in CacheManager and FilterService
• Security: SSRF protection via scheme allowlist on StreamLoader (default: file, data); dangerous extension guard and :// sanitization on S3Resolver
• Error handling: Bundle-specific exceptions in FilterManager, catch ExceptionInterface in controller, throw HttpException(500) instead of bare RuntimeException
• S3 hardening: CacheControl and optional ACL headers on putObject(), configurable via resolver factory
• DoS protection: Move pixel budget enforcement to apply() after dimension auto-calculation, covering single-dimension inputs
• Twig DX: Restore image_filter filter, add optional filter parameter to fit/fill/optimize; clean up dead code in macro template
• Configuration DX: Driver short aliases (gd/imagick/gmagick), binaries config node with defaults, strengthened exposed filter secret validation
• Boot-time validation: Verify post-processor binaries are executable at container compile time
• Tests: New FilterManagerTest (9 cases), updated S3ResolverTest, CacheManagerTest, StreamLoaderTest, ImageRuntimeTest, integration test status code assertions

Test plan

• All 338 tests pass (659 assertions, 0 failures)
• Code style clean (php-cs-fixer)
• Manual smoke test of image filter pipeline
• Verify S3 resolver CacheControl/ACL in staging environment

🤖 Generated with Claude Code