feat: check modules installed by Composer for updates

[ogorzalka]

Step 6 of the modules specification. Stacked on #438 (itself on #437): retarget to develop once they are merged.

What changes

• VersionSource contract (latest(), releaseUrl()), with ComposerRepositorySource ({url}/p2/{package}.json: Packagist, Private Packagist, Satis — highest stable version, not the first entry) and GitHubSource (latest release, else highest tag, optional token). VersionSources picks one from the root composer.json: a composer repository serving the package (its only), a GitHub vcs repository named after it, else Packagist.
• PackageVersionChecker (Application layer): current(), cachedLatest() (never fetches), refresh() (fetches, transient pollora_latest_{sha1(package)}, 12 h, 1 h negative cache), isUpdateAvailable() (a dev-*/*-dev build never is).
• ModuleVersions: a module whose real path is a Composer package's install path carries its version; local modules have none — no value, no check, no request (decision of 8 October).
• Shown in: the Version column of Plugins › Modules ("1.3.0 · 1.4.0 available", release link, composer update vendor/package), a Site Health test "Pollora modules are up to date", pollora:status / --json (version, latest per module), and pollora:module:outdated (--json), which refreshes on demand.
• Fetching: a daily WP-Cron event pollora_refresh_module_versions (scheduled from admin_init) — never during a front-end request.
• The framework's own check (PackagistVersionChecker, VersionComparator) is left as it is: it works and has its tests; moving it onto ComposerRepositorySource can come later.

Verification

• Pest: sources (p2 metadata, GitHub release/tags with token, source selection), cache and negative cache, dev builds, ModuleVersions with a real installed package's install path vs a local module, the Site Health test, the command, the Version cell.
• pollora-test (linked to this branch, then restored): the view has the Version column, pollora:module:outdated says no module is installed by Composer, the daily event is scheduled (then removed).
• Not done: the spec's "fixture module installed from a local Composer repository" check — it needs a change to pollora-test's composer.json/composer.lock, which hold uncommitted work. To do on a scratch project before the release.

Full suite 1954 passed; PHPStan, Rector, Pint, type coverage clean.