fix(validation): guard response validation against malformed content and response specs

[wadakatu]

Summary

ResponseBodyValidator and OpenApiResponseValidator lacked the
malformed-schema guards that RequestBodyValidator already had, so the two
sides of the contract behaved asymmetrically on a broken spec. This adds
symmetric guards at every level of the response spec so a non-array
responses[$status] entry, a non-array content block, a non-array
content[mediaType] entry, or a non-array schema is surfaced as a loud
spec-level error.

Why

Fixes #256. Fixes #258.

With no guard, a malformed responses map produced one of two bad outcomes on
the response side:

• Uncaught TypeError — a non-array responses[$status] entry, a non-array
  content block, or a non-array schema on a JSON media type reached an
  array-typed parameter (validateBody() / validateHeaders() /
  ResponseBodyValidator::validate()) or OpenApiSchemaConverter::convert().
  TypeError extends Error, not RuntimeException, so validateBody()'s
  catch never saw it — the run crashed with a stack trace instead of a readable
  spec error.
• Diagnostic-free silent pass — a non-JSON media type's schema: null was
  read as "no schema" by the isset(...['schema']) skip check (issue tech-debt(validation) — spec が宣言した非 JSON Content-Type のボディが診断なしで素通りする #254) and
  slipped through as a clean success. The request side rejects the same
  schema: null loudly, so request and response disagreed.

Both contradict the contract-testing principle of surfacing malformed specs
rather than masking them, and broke parity with RequestBodyValidator's guards.

#258 (the non-array responses[$status] entry) was originally split out as a
follow-up; it is the same logical change one level up, so it is folded into this
PR.

Verification

Failing tests were added first (each reproducing a TypeError or a silent
pass), then the guards were implemented. array_key_exists (not isset) is used
so an explicit schema: null is also flagged.

A multi-agent review (/pr-review-toolkit:review-pr) prompted additional tests:
orchestrator-level tests for the malformed media-type-entry and malformed/null
schema guards (for parity with the request-side OpenApiRequestValidatorTest),
a non-JSON non-null scalar schema case, and a test pinning that the guard
pre-scans every media-type entry regardless of content negotiation.

• composer test passes (1815 tests)
• composer stan passes
• composer cs-check passes

Notes for reviewers

• The guards live at the level each malformed shape first becomes reachable: the
  responses[$status] and content-block guards in
  OpenApiResponseValidator::validate() / validateBody() (their array-typed
  parameters are the crash site), and the per-entry / per-schema guards in
  ResponseBodyValidator::validate(), mirroring RequestBodyValidator.
• The responses[...] status in the error message uses the matched spec key for
  the responses[$status] guard (a literal spec pointer) and the wire status
  code for the content-level guards (consistent with the validator's existing
  (status N) messages). When the matched key is a range (5XX) or default,
  the wire-status form is not a literal pointer but is enough to locate the
  malformed content.
• Out of scope and tracked as tech-debt(validation) — OpenApiResponseValidator の spec traversal が非配列の構造ノードで未捕捉 TypeError になる #259: a malformed (non-array) structural node
  above responses[$status] — a non-array paths, path item, operation, or
  responses map — still raises an uncaught TypeError in the spec-traversal
  path of validate(). Hardening that traversal is a separate concern from the
  per-response malformed guards this PR adds.