ci: add composer-normalize, conventional-pr-title, dclint; bind compose ports to localhost

[kojiromike]

Summary

Brings oce-cli-import-codes closer to parity with oce-cli-manage-users on the CI side, and incidentally fixes localhost-only port binding so dclint passes.

New CI workflows

Callers of openCoreEMR/github-workflows-public@0.0.4:

• composer-normalize — composer normalize --dry-run (ergebnis/composer-normalize is already in dev deps)
• conventional-pr-title — validates PR titles against the conventional-commits spec
• dclint — lints compose.yml

compose.yml changes (required to make dclint pass)

• All published ports switched from short-form (- "80") to long-form with host_ip: 127.0.0.1, so the dev MySQL/CouchDB/etc. no longer expose to 0.0.0.0.
• Added required name: oce-cli-import-codes.
• Alphabetized services and reordered service keys per dclint expected layout.

Behavior change: anyone who relied on LAN access to the dev stack now needs an SSH tunnel or to set host_ip: 0.0.0.0 explicitly.

.dclintrc.json

Mirrors oce-cli-manage-users. Disables the no-duplicate-exported-ports rule, which false-positives on long-form ports without a published field (Docker assigns each service a distinct random host port; dclint reads the published key as empty string and treats them as duplicates).

Not added (and why)

• composer-require-checker — needs both a maglnet/composer-require-checker dev dep and a .composer-require-checker.json config file. Add separately when ready.
• hadolint — no Dockerfile* in the repo today.

Pre-existing issue uncovered (not in scope here)

The phpunit and phpunit-coverage services in compose.yml reference dockerfile: Dockerfile.test, which does not exist in the repo. Hidden today because both services are under profiles: [test] and only run on explicit invocation. Worth a follow-up to either add the Dockerfile or remove the phantom services.

The structural refactor (move openemr/openemr to tools/openemr/ sub-vendor pattern, rewire compose.yml + Taskfile.yml + phpstan script) is deferred to a separate PR.

Test plan

• All new CI checks pass on this PR (actionlint, composer-normalize, conventional-pr-title, dclint)
• Existing checks still pass (phpunit, phpcs, phpstan, rector, etc.)
• Local task dev:start still brings up the stack (ports now on 127.0.0.1)