feat(metadata): resolve %param% in yaml/xml and attribute resource config

[soyuka]

What

Resolves Symfony container parameters (%param%) in resource configuration regardless of the source — YAML, XML and PHP attributes. Consolidates and supersedes the YAML/XML-only #8282; the whole thing ships as one feature targeting main.

Closes #8104.

Why

%param% previously only resolved for the resource class key. Scalar fields went through verbatim, and attribute values — being raw PHP literals — reached ExpressionLanguage as %param% and threw Unexpected token "operator" of value "%". The reporter's security: '%param%' is the canonical case.

How

• ContainerParameterResolver (src/Metadata/Util/) — DI-free (PSR ContainerInterface), reuses Symfony's router regex (/%%|%([^%\s]++)%/, %% escapes a literal %, env() forbidden, arrays resolved recursively). The metadata component gains no symfony/dependency-injection dependency.
• YAML/XML — AbstractResourceExtractor now delegates to the shared resolver (the duplicated router logic is removed); phpize() resolves scalar strings, expression fields opt out and route through resolveExpressionPlaceholder().
• Attributes — a Symfony-bridge decorator ContainerParameterResourceMetadataCollectionFactory walks each resource + operation and substitutes via the immutable with*() setters.

Resolution rules (uniform across sources)

• Scalar fields — substitution anywhere: shortName, description, uriTemplate, routePrefix, routeName, host, controller, securityMessage, securityPostDenormalizeMessage, securityPostValidationMessage, provider, processor.
• ExpressionLanguage fields — whole-string %param% only (^%[^%\s]+%$): security, securityPostDenormalize, securityPostValidation, condition. A bare %param% is invalid ExpressionLanguage, so resolving it can't break a working expression; partial % and real modulo (object.value % 2) reach the engine verbatim.
• Excluded: class (resource identity) and array/context fields (normalizationContext, defaults, requirements, filters …).

BC

Purely additive — %param% in these positions previously threw or was ignored, so no working configuration changes behavior.

Tests

• Extractor unit tests (YAML + XML): scalar resolves, whole-string security resolves, real expression untouched.
• Decorator unit test (attributes): same matrix.
• Functional ApiTestCase ×2 — a YAML-config resource and an attribute-defined resource, both security: '%param%' → ROLE_ADMIN 200 / ROLE_USER 403 / anonymous 401.