Drop FlashComponent type assertion in flash key resolver (#59)

The auto-resolve path in _resolveFlashKey() asserted that the loaded
Flash component is a Cake\Controller\Component\FlashComponent, but
alternative Flash plugins (such as dereuromark/cakephp-flash) provide
their own component under the same `Flash` alias without extending the
core class. With zend.assertions=1 (PHP dev default), the assertion
threw AssertionError and broke any controller using such a component.

The call only relies on getConfig('key', ...), which is provided by
every Cake\Controller\Component subclass via InstanceConfigTrait, so
the narrower type guard was redundant. Drop the assertion and the
now-unused FlashComponent import. Add a regression test that loads a
non-core stand-in Flash component.

Improve code quality, security, and documentation (#53)

## Changes Made:

### Security & Best Practices
- **Use JSON_OPTIONS for XSS protection**: Apply the defined JSON_OPTIONS constant (JSON_HEX_TAG, JSON_HEX_APOS, JSON_HEX_AMP, JSON_HEX_QUOT) in _serialize() method for consistent XSS protection
- **Use static:: instead of self::**: Follow PSR2R standards for late static binding

### Code Quality
- **Remove deprecated passedArgs**: Removed 'passedArgs' from $_passedVars array (deprecated in CakePHP 3.x, removed in 4.x)
- **Simplify empty() check**: Replace unnecessary empty() call with direct truthy check per coding standards

### Configuration & Documentation
- **Fix PHPStan bootstrap path**: Simplify from `%rootDir%/../../../tests/bootstrap.php` to `tests/bootstrap.php` for better portability
- **Update CakePHP documentation link**: Update Contributing.md link from CakePHP 3.0 to 5.0 documentation

## Quality Checks

All quality checks pass:
- ✓ Tests: 13 tests, 31 assertions
- ✓ PHPStan Level 8: No errors
- ✓ PHPCS: No violations

Update CI

Fix plugin class name

Adjust constraint

Update ci.yml

Update README.md

stablize

Fix CS

Fix docs