PHP 8.4 / Magento 2.4.8+ compatibility, beacon + CSP fixes, encrypted token & docs

[allrude]

Summary

Brings the module up to date for modern Magento, fixes two functional bugs in the
beacon integration, adds an encrypted token field, and ships a complete user guide.

The public config paths (basicrum/general/*) are unchanged, so existing
configuration keeps working after upgrade.

Why

• The Composer PHP constraint (^8.1|^8.2|^8.3) excluded PHP 8.4, blocking
  installation on Magento 2.4.9.
• The frontend built a Boomerang config object but never called init, so the
  beacon URL and plugin settings were inert.
• There was no CSP handling, so beacons were blocked on strict-CSP 2.4.x stores.
• The "Consent Settings" admin UI was shown but never actually did anything.

What's in this PR

Functional fixes

• Initialise Boomerang for real — push ["init", config] through BOOMR_mq so the
  configured beacon_url / cookie flags / plugins actually take effect.
• Deferred send via the public API — replace the never-registered custom
  WaitAfterOnload plugin with autorun: false + a delayed BOOMR.page_ready().
• Dynamic CSP — new Model/Csp/BeaconPolicyCollector adds the configured beacon
  origin to connect-src + img-src, registered in CompositePolicyCollector.
  No manual csp_whitelist.xml needed since the endpoint is admin-configurable.

New feature

• Encrypted "Beacon Token / Site Key" field (basicrum/general/token,
  obscure + Encrypted backend). When set, it is decrypted and appended to the
  beacon URL as &token=… (URL-encoded, respecting an existing query string).

Compatibility

• composer.json: PHP ~8.3.0 || ~8.4.0; replace * wildcards with bounded
  ranges; add the modules actually used (module-config, module-backend, module-csp).
• etc/module.xml: declare <sequence> for Store / Config / Backend / Csp.
• PageTypeDetector: inject App\Response\Http (the base ResponseInterface
  doesn't declare getStatusCode()), strict === 404, map cms_noroute_index, memoise.

Cleanup & security

• ViewModel exposes a typed, null-safe API; template renders nothing when unconfigured,
  standardises on $escaper->escapeJs, keeps the CSP-safe SecureHtmlRenderer.
• Trim PageTypeDetectorInterface to the method in use; add return types to admin
  blocks; move the Logo field's markup out of PHP into a template + CSS.
• Beacon Endpoint field validates as a URL.
• Centralise the Boomerang version in Model\Boomerang; rename the vendored file to
  a version-agnostic boomerang.min.js.
• Add a real LICENSE (MIT + BSD-3-Clause notice for bundled Boomerang); fix the
  README (previously claimed PHP 7.2 / Magento 2.3).

Docs

• Self-contained docs/user-guide.html (install, endpoint/token, config, CSP,
  verification, FAQ, troubleshooting), plus CHANGELOG.md.

Behaviour changes

• Minimum requirements raised to PHP 8.3 / Magento 2.4.8.
• Removed the non-functional consent group (consent/enabled, consent/mode)
  and its ConsentMode source model — they were never read by any code. Real consent
  gating can be reintroduced as a proper feature later.

How to test

1. composer require the branch, bin/magento module:enable BasicRum_Analytics,
   setup:upgrade, cache:flush.
2. Set Enable = Yes and a Beacon Endpoint (optionally a Token), save, flush.
3. Load a storefront page → in DevTools Network a beacon fires to the endpoint with
   p_type + p_gen=mage2 (and &token=… if set).
4. With CSP in restrict mode, confirm no CSP violation for the beacon host.

Notes

• The vendored library is release build 815, "cutting-edge" plugin flavour
  (bundles Continuity) — a plugin-set name, not an unstable channel; npm latest
  (1.815.1) is the same build. Kept as-is; only the filename/version bookkeeping changed.