dont depend on phpstan as project dependency

[jrushlow]

Implementing tools/phpstan in say reset-password-bundle, so we can remove the dependency requirement in the project's composer.json (require-dev), causes the test suite to blow up. our global phpstan CI run looks for vendor/bin/phpstan. This changes it to tools/phpstan/vendor/bin/phpstan .

---

Review / update these repos if they're using phpstan as a project dependency (implement tools/* & composer scripts)

• knpuniversity/oauth2-client-bundle [dx] keep tooling in one place knpuniversity/oauth2-client-bundle#445
• symfonycasts/reset-password-bundle [dx] keep tooling in one place reset-password-bundle#325
• symfonycasts/verify-email-bundle [dx] keep tooling in one place verify-email-bundle#188
• symfonycasts/messenger-monitor-bundle [dx] keep tooling in one place messenger-monitor-bundle#59
• symfonycasts/tailwind-bundle [dx] keep tooling in one place tailwind-bundle#59
• symfonycasts/sass-bundle [dx] keep tooling in one place sass-bundle#70
• symfonycasts/micro-mapper [dx] keep tooling in one place micro-mapper#13
• symfonycasts/dynamic-forms [dx] keep tooling in one place dynamic-forms#28

[jrushlow]

We need to merge this first before we can merge the dependent PR's.