[CodeQuality] Skip event and session params in ControllerMethodInjectionToConstructorRector

[TomasVotruba]

Two params must never be moved to the constructor:

• Symfony\Contracts\EventDispatcher\Event subtypes - an event subscriber method living inside a controller is not an action, the event is passed by the dispatcher
• SessionInterface - request-scoped, must stay in the action method signature

Both skips are type-based, so any subtype is covered (e.g. RequestEvent extends KernelEvent extends Event).

Before/after

Reported from Mautic's SecurityController, which implements EventSubscriberInterface:

-final class SecurityController extends CommonController implements EventSubscriberInterface
-{
-    public function onRequest(RequestEvent $requestEvent): void
-    {
-        $controller = $requestEvent->getRequest()->attributes->get('_controller');
-    }
-}
+// unchanged

Previously the rule turned RequestEvent $requestEvent into a constructor dependency, breaking the listener.

Same for session:

 final class SomeController extends AbstractController
 {
-    public function __construct(
-        private readonly SessionInterface $session
-    ) {
-    }
-
-    public function someAction()
+    public function someAction(SessionInterface $session)
     {
-        $this->session->invalidate();
+        $session->invalidate();
     }
 }

Covered by 2 new fixtures.