[ondrejmirtes]

Adds Type::toNumberSet(): ?NumberSet, which describes the numbers a type holds as integer intervals, float intervals and a NAN flag. The trait default returns null; it is implemented on IntegerType, ConstantIntegerType, IntegerRangeType, FloatType, ConstantFloatType, FloatRangeType and UnionType.

The arithmetic operators +, -, *, /, << and >> now run as NumberSet methods, such as NumberSet::add(NumberSet $right, PhpVersion $phpVersion), instead of the instanceof chains in OperatorTypeHelper. Each pair of members is computed on its own: two integer intervals use the integer rules, and every other pair uses the float interval corners.

Ranges are kept as intervals and are never expanded value by value. Above CALCULATE_SCALARS_LIMIT, a set collapses to its hull.

Two commits:

1. Describe the numbers a type holds with Type::toNumberSet(). The interval readers in OperatorTypeHelper and ExponentiateHelper now read the set.
2. Compute the numeric operators on NumberSet. This removes integerRangeMath, floatRangeMath, floatIntervalMath and the related helpers. Float members of integer unions are now computed instead of passed through: int<1, 5> + (1.5|2) is float<2.5, 6.5>|int<3, 7>.

Changed expectations, each narrower and still sound:

• int<5, max> / -2 is int<min, -3> (was int<min, -2>, which was wrong: 6 / -2 = -3 is the first exact integer result)
• 1 / $int is -1|1|float
• $float * 0 is 0.0|NAN, and 0 * $intOrFloat is 0|0.0|NAN
• rand() * 0.1 is float<0.0, max>
• in for ($xi = $x0; $xi < $xn; $xi += 0.1), $xn is int<2, max>

Both commits include the Turbo C++ mirrors (NumberSet.cpp, OperatorTypeHelper.cpp). The test suite passes with and without the extension. A local operator fuzzer that compares the inferred types with runtime results on PHP 7.4 to 8.6 passes, and self-analysis output is identical with Turbo on and off on PHP 8.4 and 8.5.