Return the picked keys from array_rand()

[zonuexe]

Builds on #6222. Its first commit is cherry-picked here so this branch analyses on its own; I will rebase it away once it lands.

Problem

array_rand() threw away what it knew about the keys. It collapsed the key type into int, string or int|string, and returned array<int, key> whenever $num was more than one:

/** @param array{a: 1, b: 2, c: 3} $shape */
function f(array $shape): void {
    array_rand($shape);      // string
    array_rand($shape, 2);   // array<int, string>
}

Change

Hand back the key type itself, and build a tuple when $num is a known constant:

call	before	after
array_rand($shape)	string	'a'|'b'|'c'
array_rand($list)	int	int<0, max>
array_rand($shape, 2)	array<int, string>	array{'a'|'b'|'c', 'a'|'b'|'c'}
array_rand($shape, $atLeastTwo)	array<int, string>	non-empty-list<'a'|'b'|'c'>
array_rand($shape, $positive)	array<int, string>|string	'a'|'b'|'c'|non-empty-list<'a'|'b'|'c'>

An array comes back only when $num is at least 2, since a single pick returns the key on its own. That makes the list non-empty in every branch that produces one.

KEY_COUNT_LIMIT caps the tuple at 100 elements. Past that ConstantArrayTypeBuilder would degrade the shape anyway.

The keys run through castReadKeyType() from #6222, so array<string, X> gives (int|string) rather than a certain string.

array_rand([]) returns never now

array_rand([]) throws a ValueError on PHP 8, so never is the honest type. It also makes everything after the call unreachable, which cost the second call in data/array_rand.php its diagnostics. The two calls sit in separate functions now.

Tests

nsrt/array-rand.php is new. nsrt/array-functions.php and data/bug-9803.php gain precision, and two rule tests carry the new types in their messages.