Prepare the application skeleton for CakePHP 6

[josbeir]

Prepare the application skeleton for CakePHP 6 and PHP 8.4+, using controller attributes for routing and public/ as the webserver document root.

Changes

• Incorporate #1055: rename webroot/ to public/, including the front controller, static assets and Apache rewrite file. Update application paths, root rewrites and setup instructions; remove the old directory.
• Update dependencies to CakePHP 6, Migrations 6.x-dev, Bake 4, DebugKit 6, CodeSniffer 6 and PHPUnit 13. Update the PHPUnit XML schema to 13.0; running tests requires PHP 8.4.1+.
• Connect / and /pages/* using two #[Get] attributes on PagesController::display(), with DashedRoute inherited from AppController.
• Bootstrap attribute routing in Application::routes(). Keep a minimal config/routes.php with a commented conventional route example, loaded through a direct parent::routes() call. The framework handles a missing file. The file remains optional and can be deleted.
• Configure attribute metadata caching for production and disable persistent caching in debug mode.
• Update the container interface, PHP 8.4/8.5 CI matrix, documentation and welcome page.
• Test named routes, optional route configuration with and without a file, missing pages, traversal protection, routing constraints and CSRF handling.

Dependencies

This PR remains a draft until these upstream fixes merge:

• Migrations #1121: CakePHP 6 dependencies and runtime compatibility.
• CakePHP #19663: repeated route attributes on one action.
• CakePHP #19665: optional loading of config/routes.php in BaseApplication.

CI currently stops at Composer because the published Migrations 6.x branch requires CakePHP 5 components. Once installation is unblocked, the route tests also need the framework fixes.

Validation

Tested locally on PHP 8.5.11 with all three upstream fixes applied in a temporary installation:

• Highest dependencies / PHPUnit 13.4.1: 15 tests, 39 assertions, all pass.
• Lowest dependencies resolved for PHP 8.4.1 / PHPUnit 13.0.0: 15 tests, 39 assertions, all pass.
• PHPCS and PHPStan 2.3 pass for both dependency sets.
• The missing-route-file regression test fails before CakePHP #19665 and passes with that fix applied.
• HTTP smoke checks with bin/cake server confirm the public/ document root, both page routes, CSS/fonts/images/favicon, production 404 responses and DebugKit plugin assets.
• All 29 moved files retain their original contents.

Execution on PHP 8.4 is covered by the CI matrix once the dependencies are available.

[dereuromark]

We might want to start including #1055