ci: allow PHP 7.2-compatible PSR-7 dependency

[Litarnus]

Summary

• explicitly ignore the four guzzlehttp/psr7 advisories affecting the PHP 7.2.0-compatible release
• retain the existing PHP 7.2.0 minimum instead of introducing a BC break
• scope the exceptions by advisory ID so future advisories still block dependency updates

Context

Composer now blocks guzzlehttp/psr7 1.9.1 because of these advisories. All fixed releases require PHP 7.2.5 or newer, so upgrading would raise the package minimum.

Test plan

• composer validate --strict
• composer update --dry-run --no-progress --no-interaction --prefer-dist
• composer audit --locked --no-interaction --abandoned=ignore
• vendor/bin/phpstan analyse
• vendor/bin/phpunit --testsuite unit