[rennf93]

Summary

Closes the E15 fieldization note from the PHP-family feature matrix: the telemetry mute lists were only reachable through the EventFilter constructor seam and are now SecurityConfig fields with the reference default (the empty set, exact identifier strings).

• SecurityConfig grows mutedEventTypes / mutedMetricTypes (validated string lists, with()-safe).
• EventBus derives its EventFilter from the config's mute lists when none is injected; an explicitly injected filter still wins (the AgentHandlerComposer wiring keeps precedence).

Tests

• bin/test_events_parity.php: a non-empty muted_event_types mutes the headers event through the derived filter, an empty list keeps it, the defaults are the empty sets, and the constructor round-trips the lists.

Gates

• composer validate, composer audit --locked, php -l sweep, every bin suite plus all conformance runners green, coverage gate PASS.