fix: an array parameter with a bad element is refused, not a 500

[blaipr]

Filter::getArray() picked a filter per element with is_numeric() and handed the element straight
on. Under strict types getInt() accepts only int|string and getString() only ?string, so a
bool, a float, a nested array or an object threw a TypeError:

[true] -> TypeError: Filter::getString(): Argument #1 ($value) must be of type ?string
[1.5]  -> TypeError: Filter::getInt(): Argument #1 ($value) must be of type string|int
[[1]]  -> TypeError: Filter::getString(): Argument #1 ($value) must be of type ?string

Nothing caught it, and the API's catch-all answers a TypeError as a 500 with the class, the
method and the server's absolute path in the body — the leak that getParamInt(),
getParamString() and getParamRaw() were already fixed to refuse with a 400. getParamArray() was
the one reader ParameterTypesTest called "always right". It was right about the container
(is_array()) and never looked inside it.

Both doors reach it

• API — getParamArray() → Filter::getArray(). Sending {"tagsId": [true]} to account create
  was enough.
• Web — Request::analyzeArray() → Filter::getArray(). It reads through InputBag::all(),
  which skips Symfony's own scalar check, so a form field named other_users_view[x][] makes one
  element an array from an ordinary authenticated submission.

The change, in both places it belongs

• Filter::getArray() decides by type rather than by is_numeric() alone, and answers an
  element it cannot represent as null, the same as a missing one. This is the shared point both
  doors meet, so neither can 500 from it again.
• Api::getParamArray() also checks the elements, and refuses a bad one with the same
  Wrong parameters 400 as the scalar readers — so the API keeps its documented contract rather
  than silently dropping what a caller sent.

Tests

• FilterTest is new — Filter had no unit test at all. A bool, a float, a nested array and an
  object each come back as null; ids and text still come through.
• ParameterTypesTest gains anArrayParameterWithABadElementIsRefused over the same four shapes,
  plus a good id beside a bad one.

Mutation-verified in both directions: reverting src/ fails all four FilterTest cases with the
TypeError, and all four API cases with a non-400.