Review and merge #1439: pin WordPress test fixture to php 8.3.36 #1440

Could a maintainer please review and merge #1439?

It pins the WordPress integration-test fixture Dockerfile from php:8.3-cli-alpine to php:8.3.36-cli-alpine3.23. PHP 8.3.x before 8.3.36 is affected by CVE-2026-109618 and CVE-2026-109619, and a pinned tag keeps Dockerfile-based scanners from flagging the fixture. It is a one-line change to a test-only image.

I don't have write access to this repo, so the PR is from a fork and needs a maintainer's approval and merge.