fix(deps): bump league/commonmark to 2.10.0 (Dependabot security alerts)

[marianogoldman]

What

Bumps league/commonmark 2.9.0 → 2.10.0 (plus nette/schema v1.3.5 → v1.3.6, pulled along by --with-all-dependencies).

composer.lock only — no composer.json change.

Alerts closed

All four open Dependabot alerts on the repo, all high severity, all league/commonmark:

#	Vulnerable range	First patched
46	>= 0.6.0, < 2.9.1	2.9.1
45	>= 1.5.0, < 2.10.0	2.10.0
44	>= 1.5.0, < 2.9.1	2.9.1
43	>= 2.7.0, < 2.9.1	2.9.1

Highest first_patched_version across the group is 2.10.0, so one bump clears all four.

Exposure

Transitive, and inert in practice:

• composer why league/commonmark → laravel/framework v13.17.0 requires league/commonmark (^2.8.1)
• It sits in the packages section of the lock, not packages-dev, because laravel/framework declares replace of illuminate/support and satisfies our production require. So "dev-only" would have been the wrong call here.
• Nothing in src/, config/ or tests/ references CommonMark or Markdown rendering.

Why lock-only

This is a published library. Consumers resolve their own dependencies and never use our lock, so adding a require for a transitive package we don't use would push a constraint onto them for no benefit. If we ever needed to force consumers off a bad version, the right tool is conflict, not require.

Verification

• composer audit → No security vulnerability advisories found.
• composer lint → {"tool":"pint","result":"passed"}
• composer test → Tests: 9, Assertions: 4, Errors: 4, Skipped: 1

The 4 errors are PayPalApiClient::__construct(): Argument #1 ($apiClientKey) must be of type string, null given — missing local PayPal credentials. Verified via git stash that main produces the identical result (Tests: 9, Assertions: 4, Errors: 4, Skipped: 1), so this is pre-existing and unrelated to the bump.

.github/workflows/php.yml supplies PAYPAL_API_CLIENT_ID / PAYPAL_API_CLIENT_SECRET, so CI is the real gate for the suite.