Nits + BC correctness fixes from 5.x audit (followup to #1072)

[dereuromark]

Summary

Followup to #1072 -- the rest of the small, fully BC items from the same 5.x audit pass, bundled together.

Nits

• CredentialsHelper::filter() -- click handler swapped from this.innerHTML = this.title to this.textContent = this.title. A credential URL whose userinfo portion ever decodes to HTML cannot render live markup when the asterisks are revealed.
• ToolbarController::clearCache() -- if the posted engine name is not configured, throw NotFoundException instead of replying 200 / success: false. The 200/false combo was the only path where the endpoint silently misreported failure.
• RequestPanel -- collect the GET payload via $request->getQueryParams() instead of $_GET so the panel reflects the request as middleware sees it, consistent with how the query key is already collected one line above.
• Templates -- escape $pluginName in routes_panel, escape the file path in request_panel's "headers already sent" warning, guard end($timers) against an empty timers array in timer_panel, and replace extract($package) in packages_panel with explicit destructuring so a future composer.lock schema key cannot clobber template locals.

BC correctness

• DebugKitTransport::send() -- override the parent return-type docblock with the actual shape (assoc headers array + text/html message split). Runtime return value is unchanged; this just stops static analysis from papering over the LSP gap and lets the PHPStan baseline entry be removed.
• DebugKitTransport::__construct() -- reject construction without a valid debugKitLog ArrayObject up front with InvalidArgumentException. Today the missing-key path fatals with a downstream TypeError on the property assignment; this gives a clear, actionable message instead.
• ToolbarService::saveData() -- move restore_error_handler() into a finally block (guarded by an $handlerInstalled flag so it can't pop a handler that was never installed), and narrow the captured error mask to E_WARNING | E_NOTICE | E_USER_WARNING | E_USER_NOTICE. Previously any warning raised during the serialize() call, including ones from unrelated userland code touched during serialization, was mis-reported as a panel-serialization failure.

Baseline

Removes the now-stale DebugKitTransport return-type entry from phpstan-baseline.neon.

Tests added: CredentialsHelper data provider updated for the new onclick; ToolbarControllerTest gains an unknown-engine 404 case; DebugKitTransportTest gains two constructor-rejection cases (missing key, wrong type).