feat(symfony): expose voter reasons

[nozarashi20]

Q	A
Branch?	main
Tickets	Closes #7331
License	MIT
Doc PR	n/a

This PR includes Symfony voter reasons in denied HTTP and GraphQL responses when %kernel.debug% is enabled. It captures a new AccessDecision for each is_granted() call without changing the result of the security expression.

An explicit security message configured on the operation still takes priority. If no message is configured, API Platform uses the voter message in debug mode and falls back to Access Denied. when no voter message is available. Voter reasons are never exposed when debug mode is disabled.

ResourceAccessCheckerInterface is unchanged. Existing custom resource access checkers continue to work and use Access Denied. unless they provide a captured message. Custom and decorated Symfony authorization checkers continue to determine whether access is granted.

The mcp/sdk development constraint now allows ^0.7, as required by the current version of symfony/mcp-bundle. Without this change, Composer cannot install the dependencies.

Tests are split by responsibility:

• AccessDecisionCapturingAuthorizationCheckerTest checks that each authorization check gets its own decision and that messages contain the reasons added by the voters.
• ResourceAccessCheckerTest checks &&, ||, negation, failures outside is_granted(), and clearing the previous voter message before evaluating another expression.
• AccessCheckerProviderTest checks configured messages, debug and non-debug behavior, HTTP and GraphQL exceptions, and compatibility with custom resource access checkers.
• The HTTP and GraphQL functional tests check the voter reasons returned in API responses.