[rennf93]

Closes #77

I ported the verified reference fixes to the PHP engine, one commit per point, each with a test that fails on master.

• fix(logging): a passive-mode suspicious line without a trigger now reads [PASSIVE MODE] Suspicious activity detected from ... - Reason: ... - Headers: ... instead of dropping the reason under a "Penetration attempt" label (guard-core #165).
• docs(config): enableDynamicRules now lists exactly what a rule changes. This documents what PHP does today: ip_blacklist and ip_whitelist merge into the blacklist and whitelist, and ip_ban_duration is parsed but not applied, unlike the reference where the blacklist is a timed ban. I did not change that behaviour here.
• feat(detection): opt-in excludedSemanticDetectionHeaders on SecurityConfig (default empty) and RouteConfig (merged with the global set, also reachable as detectionExclusion(semanticHeaders: ...)). Listed headers skip only the semantic analyzer and the regex scan still runs.
• fix(detection): the Cookie header is scanned one name=value pair at a time (split on ;, only spaces trimmed so CR and LF stay, empty pairs skipped), each pair taking the same header path, so the semantic opt-out applies per pair (guard-core #162).
• feat(metrics): GuardEngine::processResponse now emits response_time, request_count and error_rate through a MetricsCollector the engine owns, once an agent handler with sendMetric is attached and agentEnableMetrics is on. response_time runs from the pipeline start (RequestState::$pipelineStartedAt, stamped in execute()).

I did not port the per-request scan time budget: PHP runs one request per process and detection keeps no per-request scan state shared across requests.

I left the conformance fixtures untouched.