feat(phase-c): resolve PhpMixed-conversion phase-b TODOs

Implement the foundational PhpMixed conversion infrastructure
(From<bool|i64|f64|String>, order-sensitive PartialEq matching PHP ===)
and resolve the category-G phase-b TODOs that depend on it:

- Fix VCS driver cache paths that discarded parsed JSON or diverged on
  null caches (svn/forgejo/gitlab/git-bitbucket/github).
- Wire up real conversions previously stubbed or dropped: suggests
  platform config, audit ignore-severities, composer_repository search
  and ProviderInfo, class_loader prefix/classmap merges, locker lock
  diff comparison, advisory JSON serialization, SPDX license fields.
- Make GenericRule take a typed ReasonData; populate RULE_ROOT_REQUIRE
  with the constraint and convert PhpMixed at the call sites.

1 files changed, 9 insertions, 0 deletions

diff --git a/crates/shirabe/src/advisory/security_advisory.rs b/crates/shirabe/src/advisory/security_advisory.rs
index 5cb5c59..2c5a309 100644
--- a/crates/shirabe/src/advisory/security_advisory.rs
+++ b/crates/shirabe/src/advisory/security_advisory.rs
@@ -7,6 +7,14 @@ use shirabe_semver::constraint::AnyConstraint;
 use crate::advisory::IgnoredSecurityAdvisory;
 use crate::advisory::PartialSecurityAdvisory;
 
+/// Matches PHP's `format(DATE_RFC3339)`, e.g. "2020-01-01T00:00:00+00:00".
+fn serialize_date_rfc3339<S: serde::Serializer>(
+    dt: &DateTime<Utc>,
+    serializer: S,
+) -> Result<S::Ok, S::Error> {
+    serializer.serialize_str(&dt.format("%Y-%m-%dT%H:%M:%S%:z").to_string())
+}
+
 #[derive(Debug, Clone, serde::Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SecurityAdvisory {
@@ -15,6 +23,7 @@ pub struct SecurityAdvisory {
     pub title: String,
     pub cve: Option<String>,
     pub link: Option<String>,
+    #[serde(serialize_with = "serialize_date_rfc3339")]
     pub reported_at: DateTime<Utc>,
     pub sources: Vec<IndexMap<String, String>>,
     pub severity: Option<String>,