Escape HTML tags in toScript() output (#242)

Adds JSON_HEX_TAG to json_encode flags so < and > are escaped to
\u003C / \u003E. Without this, a value containing </script> could
break out of the script block and execute injected HTML.

Merge pull request #241 from spatie/fix/referenced-type-cycle

Resolve @id without cascading toArray() in ReferencedType

Drop PHP 8.1, add PHP 8.5 support, fix pest/phpunit conflict

- Require PHP ^8.2 (pest v2.36.1+ requires PHP 8.2)
- Allow pest ^3.0 for PHP 8.5 compatibility
- Add PHP 8.5 to test matrix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Merge pull request #222 from Soean/schema_v_28_1

Upgrade to schema.org v28.1

Merge pull request #213 from spatie/schema-24

Schema 24

Merge pull request #212 from spatie/schema-23

upgrade to schema.org v23

Merge pull request #211 from spatie/schema-22

upgrade to schema.org v22

Merge pull request #210 from spatie/schema-21

upgrade to schema.org v21

Merge pull request #209 from spatie/schema-20

upgrade to schema.org v20

Merge pull request #208 from spatie/schema-19

upgrade to schema.org v19