refactor: safe PHP 7.4 modernization

[somethingwithproof]

This PR adds strict typing, short array syntax, and null coalescing operators across the plugin. Standalone infrastructure files were removed per architectural mandate.

[Copilot]

Pull request overview

This PR aims to modernize the plugin’s PHP code by enabling strict typing and adopting newer syntax, while also introducing security documentation and a new security-focused test suite.

Changes:

• Added declare(strict_types=1); across many PHP entrypoints and core plugin files.
• Refactored multiple arrays to short array syntax ([]) and updated some DB prepared-statement argument arrays.
• Added security policy/audit documentation plus new Pest-based security tests, and introduced PHPStan + Infection config files.

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
wmi_tools.php	Adds strict types + short array syntax refactors.
wmi_script.php	Adds strict types and refactors, but introduces an invalid function invocation.
wmi_queries.php	Short array syntax refactors and prepared statement arg updates.
wmi_accounts.php	Short array syntax refactors and prepared statement arg updates.
functions.php	Adds strict types and converts prepared-statement args to short arrays.
poller_wmi.php	Converts prepared-statement args to short arrays.
linux_wmi.php	Adds strict types and minor array refactors (no security behavior changes).
script/wmi-script.php	Adds strict types but introduces an invalid function invocation.
templates//index.php, locales//index.php, index.php, script/index.php	Adds strict types to redirect-only index files.
tests/Security/WmiSecurityTest.php	Adds new security tests, but currently contains PHP syntax errors and version mismatches.
tests/Security/ShellInjectionTest.php	Adds security tests, including an active regression assertion that will fail until implementation is updated.
SECURITY.md / SECURITY-AUDIT.md / BACKLOG.md	Adds security policy, audit findings, and remediation backlog documentation.
phpstan.neon	Adds PHPStan config but references a non-existent src/ directory and sets PHP version inconsistently with PR goal.
infection.json	Adds Infection config targeting src/ which does not exist in the repo.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

phpVersion: 80400 (PHP 8.4) and the added code/tests using PHP 8+ features don’t align with the PR’s stated goal of “PHP 7.4 modernization”. Please clarify the supported PHP version for this plugin and set phpVersion (and any new syntax/features) accordingly.

[somethingwithproof]

Converted to draft to serialize the stack in this repo. Blocked by #8; will un-draft after that merges to avoid cross-PR merge conflicts.

[somethingwithproof]

Pushed two fixes:

• Added the CI workflow (this branch predates it and never ran a single check).
• `phpstan.neon`/`infection.json` pointed at a `src/` dir that doesn't exist in this plugin; repointed at the actual layout.
• `ShellInjectionTest.php`'s FIND-001/002/003/005 blocks asserted against local literals (not `Linux_WMI`/`functions.php`) and described bugs (unescaped hostname, raw `unserialize()`, unparameterised `id`) that were already fixed earlier in this branch (`clean()` already calls `cacti_escapeshellarg()` on hostname, `functions.php` already uses `db_fetch_row_prepared`). Removed the stale narrative, kept the real FIND-004 test which does check the shipped file.
• `setup.php`: converted the two remaining raw `db_fetch_cell()` hash lookups to `db_fetch_cell_prepared()`.
• `poller_wmi.php`: `sizeof()` -> `cacti_sizeof()` to match the rest of the file.

Left one thread open: `phpstan.neon` still declares `phpVersion: 80400` while the PR title says "PHP 7.4 modernization" (CI itself only tests 8.1-8.4, so the mismatch is between the title and the two configs, not a functional bug). Didn't want to guess at intent there — worth a maintainer call on which target this plugin actually supports.

Also worth noting for whoever picks up #10: the Pest suite added on this branch isn't invoked anywhere in the CI workflow (lint/syntax/poller-smoke-test only), so none of these security regression tests actually run in CI yet.