fix(compatibility): remove undeclared PHP 8.4 mb_trim dependency from PHP 8.3 runtime #9

Problem

The package declares PHP ^8.3, but header helpers call mb_trim(), which is only built into PHP starting in 8.4. Neither a PHP 8.4 polyfill nor ext-mbstring is required by this package's runtime dependencies. Development tooling can hide this production-only gap.

Pinned evidence

Audited commit: a429fbe9a7efce6cee50b82e4a981ea7e3b47a5f.

• composer.json runtime requirements
• Accept.php:93
• Other affected helpers: ContentType:96, ContentEncoding:131–137, Authorization:271–280/326–335 and TransferEncoding:115; several also require mb_strtolower.
• PHP manual: mb_trim introduced in PHP 8.4.

Safe reproduction

In a clean PHP 8.3 consumer installed with --no-dev, load the Composer autoloader and call:

FastForward\Http\Message\Header\Accept::getBestMatch(
    'application/json',
    [FastForward\Http\Message\Header\Accept::ApplicationJson],
);

Expected: ApplicationJson. Source-predicted result without an unrelated polyfill: undefined-function Error for mb_trim. On newer PHP without mbstring, the undeclared extension requirement can also fail.

Acceptance criteria

• Preserve the advertised PHP 8.3 support using appropriate ASCII header parsing, or declare and ship the necessary runtime compatibility dependency.
• Cover all mb_* calls, not just Accept.
• Add isolated no-dev consumer checks on PHP 8.3; ensure development dependencies cannot provide missing runtime functions accidentally.

Priority P1 (advertised runtime paths fail); confidence high. This is a runtime compatibility finding, not a vulnerability claim. Validation is source-level plus official function availability documentation; PHP execution was unavailable. All existing issue/PR records #1–#8 were checked and no matching task exists.