Move to Symfony 5.4 running on PHP 8.5 (composer requires PHP >= 8.4).
Only the dependencies requiring it are upgraded: API Platform 2.7, ORM
2.20 (DBAL stays on 2.13), knp-paginator 5, lexik translation 6,
sensio extra 6, shivas versioning 4, exporter 3, nelmio api-doc 3.10.
SwiftMailer and the Guard authenticators still work on 5.4 and will be
replaced with Symfony 6.

Code adapted to Symfony 5: kernel event classes, contracts translator,
token role names, form extension return types, legacy event base class,
kernel.root_dir, Lexik controllers, decimal fields of the geoloc form.

Fix regressions found by the tests:
- @IsGranted with several roles meant "any of them"; Symfony 5.4 no
  longer supports several attributes and denied access to everybody on
  12 routes. Use explicit security expressions.
- A comptoir form template rendered fields twice through parent().

Tooling: php-cs-fixer 3 (.php-cs-fixer.dist.php), GrumPHP 1, the custom
translation:update command is removed (use translation:extract). The
smoke test keeps cookies around stateless API requests (mock session
storage artifact, checked against native sessions).