Drop Laravel 10/11 support, pin GitHub Actions to SHAs, add Dependabot

[Orrison]

Laravel 10 and 11 are end-of-life and no longer receive security fixes, so this drops them and tightens the CI and dependency setup to match what was done in modular-livewire (#4 and #6 there).

Laravel support

• illuminate/support is now ^12|^13 and php is >=8.3 (Laravel 13 and modular 3 both already require PHP 8.3).
• orchestra/testbench is ^10.1|^11.0 and phpunit/phpunit is ^11.5|^12.5|^13.0.
• The dev-main/dev-master/12.x-dev aliases are removed and minimum-stability is stable.
• The PHPUnit matrix now runs Laravel 12 and 13 on PHP 8.3, 8.4 and 8.5, on Ubuntu and Windows, with stable and lowest dependencies.

Note on internachi/modular

With minimum-stability: stable, the previous internachi/modular: "*" dev requirement resolved to modular 2.3.0, which only allows Laravel 13 as 13.x-dev. That meant the Laravel 13 leg could not resolve. It is now pinned to ^3.0.

Modular 3 in turn requires internachi/modularize ^1.1, and this repository identifies to Composer as dev-main, which does not satisfy that. A dev-main => 1.x-dev branch alias is added under extra so the root package satisfies the constraint both locally and on the detached checkout CI uses. Once modular is updated to require modularize 2.x, that alias should move to 2.x-dev and the dev requirement to the matching modular version.

GitHub Actions

• Every uses: is pinned to the commit SHA of the action's latest release, with the version in a trailing comment so it stays readable. The SHAs were verified against each repository's release tags.
• .github/dependabot.yml enables weekly github-actions updates with a 7 day cooldown, so Dependabot keeps the SHAs and version comments current.

Verification

Each matrix leg was resolved from scratch locally (no lock file, like CI) and the test suite passes on all of them:

Leg	Resolved
12.* stable	framework 12.69.1, testbench 10.11.0, modular 3.0.2
12.* lowest	framework 12.61.1, testbench 10.1.0, modular 3.0.0
13.* stable	framework 13.30.1, testbench 11.2.0, modular 3.0.2
13.* lowest	framework 13.12.0, testbench 11.0.0, modular 3.0.2

composer validate --strict and the php-cs-fixer dry run both pass.

Since this drops supported Laravel versions, the next release should probably be 2.0.0. internachi/modular currently requires modularize ^1.1, so a 2.0 release will not reach modular users until modular is updated to allow it.