Fix all translations files and harden their consistency

[Vondry]

Summary

Audits and repairs the messages, security and validators translation catalogues (translations/*.xlf, 3 domains × 15–17 locales, 45 files). It also adds two scripts that keep the catalogues correct and in sync from now on.

Rebased onto 6.1.9. Several earlier fixes have since landed on master separately: the XLIFF 1.2 → 2.0 conversion, the trgLang/<file id> header corrections, general.phrase.none, the Slovak catalogues, and a number of placeholder fixes. This PR builds on top of those.

Translation catalogue fixes

• Removed dead keys from the English catalogues: 83 unused keys from messages.en.xlf (leftovers from deleted templates, replaced field labels, keys duplicated from other domains, unused language-name labels, etc.) and 29 from validators.en.xlf (corrupted entries with hex-string keys and obsolete demo entries). Every locale was cleaned up to match.
• Added the three Symfony login-throttling messages to the security domain. The app uses them, but they were missing from the catalogues. Locale targets come from Symfony's own vendor catalogues.
• Synced every locale with English: each locale file now has the same keys, order, unit ids and notes as its English counterpart, and is identical to it outside the <target> elements. This fills in about 1,650 missing keys with real translations, including:
  • validators.it, validators.pl and validators.pt_BR, recreated from Symfony's vendor catalogues (they previously contained only invalid entries);
  • messages.pt_BR.xlf, brought back with full translations (it was removed earlier only because it was empty).
• Fixed 116 incorrect translations that master still had wrong:
  • untranslated English left in place (e.g. most zh_CN strings, nl/it/el UI labels);
  • raw keys used as the translation (title.edit_user_profile, caption.kitchensink, image.placeholder_filename);
  • wrong meanings (ru "Preview" → "Список", fr "Display name" → "Afficher le nom", nl "No files…" → "Aantal bestanden");
  • truncated strings and missing sr-only spans;
  • a broken nested CDATA in de password.suggested.
• Unit ids in messages.fr now match English (12 reset_password.* / form units).
• Regenerated the <notes> blocks in every catalogue so they record where each key is actually used. messages notes point to in-repo path:line locations. security and validators notes fall back to the Symfony vendor file a key comes from when the project itself doesn't use it.

New tooling

• bin/validate-translations: a validator that can run in CI (exits with 1 on failure). It checks:
  • a fixed list of expected domain.locale.xlf files (a missing file is an error);
  • that every locale matches English: keys, unit ids, <notes>, order and file structure outside the targets;
  • correct <file id> and trgLang headers;
  • malformed or truncated XML, which it reports as an error instead of crashing;
  • that every messages key is used somewhere in the codebase (code, templates, themes or bundled widgets), and that every trans(), |trans or __() call points to a key that exists.
• bin/update-translation-notes: regenerates the <notes> blocks from actual usage and copies them unchanged into every locale.
  • For security and validators keys not used in the project, it falls back to Symfony's vendor sources.
  • Approximate (non-exact) matches are prefixed with ~, and locations are sorted by line number.
• Wired into CI (.github/workflows/code_analysis.yaml): php bin/validate-translations runs next to the existing lint:xliff step.

Testing

• php bin/console lint:xliff translations/: all 45 catalogue files are valid.
• php bin/validate-translations: passes (exit code 0).
• php bin/update-translation-notes: running it again changes no files.
• Every locale target uses the same placeholders as its English source. The one exception is on purpose: the German one-minute throttling message says "einer Minute", matching Symfony's own catalogue.
• Fault injection: a deleted locale file, a corrupted trgLang, malformed XML, reordered or edited <notes> and duplicate keys were each caught by bin/validate-translations. Each change was reverted afterwards.

[Vondry]

Related localization PRs:

• Localize Redactor editor UI based on Bolt backend locale redactor#41
• Localize Article editor UI based on Bolt backend locale article#49

[bobvandevijver]

This is not reviewable in it's current form. I need to ask you to split the work done in separate PRs to be able to do something with this. My suggestion for PRs would be:

1. Remove dead and duplicate keys
2. Add missing translation keys
3. Translation fixes, per locale. However, to accept translations the submitter must be able to understand the translations made. I'm not going to merge AI translations due to bad experiences with those.
4. Something with the notes and the command added

And possibly even more. Keep it simple.

[github-actions]

In an effort to keep our pull request list manageable, we are marking this PR as stale because it has been 60 days without activity. If this PR is still relevant, please let us know by posting a quick comment or update so that it can be assigned and hopefully merged.