Type $this in a Closure::bind() closure from the bound object

[zonuexe]

This PR makes $this inside a Closure::bind() closure the type of the object that is actually bound ($newThis), refined by $newScope, instead of the scope class. Until now the scope class replaced the bound object's type whenever a scope was given.

What was wrong

• Closure::bind(fn () => $this, null, Foo::class) typed $this as Foo, but PHP has no $this there ("Using $this when not in object context").
• Closure::bind(fn () => $this->im(), new NoParent(), Foo::class) was silent, but PHP fails with "Call to undefined method NoParent::im()".

Cause

The Closure::bind() scope factory in StaticCallHandler took $this from $newThis, then overwrote it with the $newScope class (or the object type of the class-string) as soon as a scope argument was present. The native $this type and the scope classes used for visibility and self:: were already right; only the PHPDoc $this type ignored the bound object.

New behaviour

• No $newThis, or a null one: no $this, whatever the scope.
• object or mixed bound into Foo::class: Foo, so the hydrator idiom Closure::bind(fn () => $this->secret, $object, Foo::class) keeps working.
• A SubFoo bound into Foo::class: SubFoo.
• A Foo bound into SubFoo::class: SubFoo.
• An unrelated NoParent bound into Foo::class: NoParent, so undefined methods and properties are reported.
• $this of the enclosing class bound into an unrelated class scope: $this(Outer) is kept. Into an interface scope: $this(Outer)&FooInterface.
• Foo|NoParent bound into Foo::class: Foo|NoParent. Each member of the union is refined on its own, so a member that cannot be an instance of the scope class is not silently dropped.
• ?Foo: stays Foo|null, as closure-bind-nullable-this.php already pins.
• A 'static' scope, or a class-string that names no known class: was *ERROR*, now the bound object's type.
• A static closure: still no $this. PHP itself returns null with a warning when an instance is bound to a static closure, so the rows without $this match PHP.

Trade-off

A member of the bound object's type that may be an instance of the scope class is assumed to be one. object or mixed becomes the scope class, which keeps the hydrator idiom working; at runtime a non-Foo object there would only produce an undefined-property warning. Likewise a Foo bound into SubFoo::class is typed as SubFoo. The native $this type keeps the unrefined bound-object type.

This is the same result as before this PR for these cases, so their existing false positives and false negatives stay: a guard such as !$this instanceof Foo or $this instanceof SubFoo is reported as always true (and the code after it as unreachable), and an unguarded $this->secret or $this->onlyInSubFoo() on an object that turns out not to be the scope class goes unreported. With treatPhpDocTypesAsCertain: false the guards are not reported, because the native $this is not narrowed. Runtime behaviour: https://3v4l.org/dhunm#v, PHPStan output: https://phpstan.org/r/51fb207e-3211-4a84-8223-34fd75956707

Related

Closure::call() already takes $this from the object it is called with. PHPStan does not re-analyse bindTo() closure bodies with a new $this at all. The scope factory still reads the Closure::bind() arguments by position; named-argument support for Closure::bind() (marking the closure in ClosureBindArgVisitor, reordering the arguments in the factory, the lookup in ParametersAcceptorSelector) is being split out of #4081 into a separate PR.

The native C++ twin in turbo-ext/src/StaticCallHandler.cpp gets the same change, with a walk-trace fixture covering each path.

This is split out of #4081, whose self:: instance-call check relies on $this being the bound object rather than the scope class.