Explore using Phive to manage tools instead of Composer

[dktapps]

Description

Having phpunit/phpunit as a Composer dev dependency is very obnoxious, because:

• its deps may conflict with ours
• everything gets dumped into the same vendor folder inseparably
  • making phar builds more inconvenient
  • also spamming IDE auto-complete with tons of junk that's hard to filter out

https://phar.io/ (Phive) is a potential solution to this problem, recommended by the PHPUnit docs. This section of the PHPUnit docs in particular provides an excellent summary of the problems faced by including phpunit into the project as a Composer dependency.

Justification

Alternative methods

We could:

• have a separate composer.json specifically for installing tools - not great because namespace collisions (phpunit.phar in particular is shaded thanks to php-scoper, and phpstan is shaded by something similar)
• curl the tools directly as-needed - inconvenient, prone to errors, and hard to remember

[dktapps]

Currently this is a bit inconvenient, because Phive uses curl SSL, which does not work in our currently distributed prebuilt PHP binaries due to missing SSL certificate bundles (pmmp/PHP-Binaries#70)

[dktapps]

This is also a bit annoying for PHPStan, since PHPStan extensions can't be easily used if we install PHPStan using Phive. However, PHPUnit will definitely benefit.