fix(gate-48): a re-indented #[NoCSRFRequired] is not a dropped one

[rubenvdlinde]

The finding

gate-48's move-cancellation compared removed and added lines by raw bytes. php-cs-fixer re-indents every controller from four spaces to a tab, so the fleet-wide move to Nextcloud's coding standard emits

-    #[NoCSRFRequired]
+	#[NoCSRFRequired]

for every attribute in the app, and the helper read all of them as deletions.

Measured on ConductionNL/launchpad#106: the helper reports 25 "removals" against a tree whose NoCSRFRequired count is 43 before the PR and 43 after — nothing was dropped, everything moved one indent level. gate-48 is red for this reason alone on 8 of the 18 apps currently migrating, and the cheapest way out would have been a [hydra-gate-csrf-cochange exclude] waiver on each: a security gate waived fleet-wide over an indentation artefact.

Why the old rule is safe to reverse

The byte-exact rule carried a stated reason, pinned by test_whitespace_is_not_normalised_away:

A re-indented line is NOT the same line. Treating it as a move would let a reformat swallow a genuine deletion.

That reason does not survive multiset accounting, which is what the cancellation already does. A re-indentation contributes exactly one addition for each removal it causes, so the net count is unchanged. Delete one annotation inside an otherwise fully re-indented file and the removals outnumber the additions by one, leaving exactly one finding.

Cancellation now keys on the line content with leading/trailing whitespace stripped. Nothing else is normalised: the attribute list is still compared verbatim, so #[NoAdminRequired, NoCSRFRequired] cannot absorb a removed #[NoCSRFRequired], and cancellation is still per file.

Measurement (real launchpad diff)

	findings	tree count before → after
pre-fix	25 (all false)	43 → 43
post-fix	0	43 → 43
post-fix, one added attribute line deleted from the diff so the head genuinely loses it	1	—

The third row is the one that matters: the gate still catches a real removal.

Tests

The old assertion is reversed, with the reason recorded at the assertion rather than in a changelog. Four arms added; the load-bearing one is test_a_genuine_deletion_inside_a_full_reindent_still_reports — four removals, three additions, expects exactly one finding. That is the arm that proves the gate was relaxed and not disabled, and it is the arm to read first if this is ever revisited.

The new arms fail against the pre-fix helper (3 failures) and pass against the fixed one (25 tests, OK), so they discriminate rather than merely agreeing with whatever the code does.