feat(http): also retry on transient status code 520

[dorsha]

Summary

Add Cloudflare status code 520 ("Web Server Returned an Unknown Error") to the HTTP client's retryable status codes, alongside the existing 503 / 521 / 522 / 524 / 530.

Like the other Cloudflare 52x codes already retried, 520 is a transient edge error returned when the origin is briefly unreachable (e.g. during pod replacement on deploy), so the request is safe to retry. Follow-up to #104; brings this SDK in line with go-sdk (descope/go-sdk#775), python-sdk (descope/python-sdk#1581) and core-js-sdk (descope/descope-js#1423).

https://github.com/descope/etc/issues/14039

Also: CI dependency fix (separate commit)

CI was red on main for every PR: #106 bumped phpunit/phpunit to ^12.0.0 in composer.json but never updated composer.lock (still 9.6.33), so composer install fails dependency resolution. phpunit 12 also requires PHP 8.3+, incompatible with the 7.4/8.1 CI matrix. This PR reverts the constraint to ^9.6.21 — the value composer.lock was last generated against (#71) — restoring a consistent, installable set. No lockfile change is needed (unchanged since #71).

Test plan

• Added 520 to retryableStatusCodeProvider in APIRetryTest.php
• CI runs the full suite (now unblocked)

🤖 Generated with Claude Code

[shuni-bot-dev]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot-dev]

🐕 Suggested Reviewers

The review assignment prioritizes recent contributors who have worked directly on the changed files, ensuring they are knowledgeable about the specific code sections affected, and covers different areas to scrutinize the update thoroughly.

Reviewer	Reason
gaokevin1	Recently modified src/SDK/API.php, so they are familiar with the core SDK logic affected by this change.
gaokevin1	Has multiple commits in the changed files, indicating active involvement and understanding of the updates.

_{Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best.}

[shuni-bot-dev]

🐕 Shuni's Review

Adds Cloudflare status code 520 to the HTTP client's retryable status codes, with matching docstring and test-data updates.

No issues found — good bones! Change is consistent across the constant, the docstring, and the test provider; 520 is correctly grouped with the other transient Cloudflare 52x codes. Woof!