CUNY Academic Commons

Bugs like #22351 could be avoided if we had some basic static analysis tools. I've set up PHPStan successfully on projects not too dissimilar to the Commons. It takes a good deal of configuration to get it set up, and getting our custom codebase to pass even the most permissive scan level will probably take some work. At the same time, the benefits are quite real: we avoid the type of simple regression in #22351, and likely also identify other latent bugs.

Ray, Jeremy, have you used PHPStan or another tool for this? I'm happy to have a first crack at it, unless one of you has other thoughts.